Integration · infra

Outbound Webhooks.

Every domain event (proposal accepted, PO approved, incident filed, payment received, advancing deliverable resolved) fires a signed HTTP webhook. HMAC-SHA256 signature on every payload. Endpoint configuration in the console settings.

Start building free Book a Walkthrough

What It Does.

Domain events for every major lifecycle transition
HMAC-SHA256 signature verification
Per-endpoint retry with exponential backoff
Failed-delivery dead-letter queue with replay
Per-org rate limits

Technical Anchor

src/app/api/v1/webhooks/* (inbound) + src/lib/webhooks/deliver.ts and supabase/functions/job-worker (outbound dispatch)

Modules That Depend On It.

Compliance

Outbound Webhooks · FAQ

How do I verify a webhook signature?

Compute HMAC-SHA256 over the timestamp, a period, and the raw request body, keyed with your endpoint secret, then compare to the x-atlvs-signature header. Reject mismatches. Sample code in the API docs.

What's the retry policy?

Exponential backoff over 24 hours: immediate, 15s, 1m, 5m, 30m, 2h, 6h, 24h. After 24h the event lands in your dead-letter queue with a replay button.

Other Integrations.

Stripe Connect Anthropic Claude Supabase Twilio Resend Google Apple Microsoft

Atlas Is Open.

Free for small teams. Every integration included.

Start building free Book a Walkthrough