Integration · infra

Outbound Webhooks.

Every domain event — proposal accepted, PO approved, incident filed, payment received, advancing deliverable resolved — fires a signed HTTP webhook. HMAC-SHA256 signature on every payload. Endpoint configuration in the console settings.

What It Does.

Domain events for every major lifecycle transition
HMAC-SHA256 signature verification
Per-endpoint retry with exponential backoff
Failed-delivery dead-letter queue with replay
Per-org rate limits

Technical Anchor

src/app/api/v1/webhooks/* (inbound) + src/lib/notify-resolver.ts (outbound dispatch)

Modules That Depend On It.

Compliance

Outbound Webhooks · FAQ

How do I verify a webhook signature?

Compute HMAC-SHA256 of the raw request body with your endpoint secret and compare to the X-ATLVS-Signature header. Reject mismatches. Sample code in the API docs.

What's the retry policy?

Exponential backoff over 24 hours: immediate, 15s, 1m, 5m, 30m, 2h, 6h, 24h. After 24h the event lands in your dead-letter queue with a replay button.

Other Integrations.

Stripe Connect Anthropic Claude Supabase Twilio Resend Google Apple Microsoft

ATLVS Is Open.

Free for small teams. All integrations included.