Signed webhooks
Every Phase 1 endpoint can subscribe to any combination of:
submission.createdsubmission.status_changedsubmission.archivedsubmission.restoredsubmission.deleted
Creation and restoration events include available submission fields. Status, archive, and deletion events contain identifiers and change metadata without retransmitting the entire lead payload.
Delivery contract
Webhook envelopes use CloudEvents 1.0.2 structured JSON. Requests include Standard Webhooks webhook-id, webhook-timestamp, and webhook-signature headers.
Delivery is at least once and not ordered. Deduplicate using the stable webhook-id. A failed event never blocks newer events.
Only 2xx succeeds. FormRoost does not follow redirects. Receivers should acknowledge quickly and perform expensive work asynchronously.
Automatic attempts occur immediately, then approximately 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, 12 hours, 24 hours, 48 hours, and 72 hours after the first attempt.
Production destinations require HTTPS. FormRoost revalidates the destination on every attempt, applies a three-second connection timeout and ten-second total timeout, and never follows redirects. Endpoint health becomes degraded after failures; a bounded circuit breaker protects both systems without permanently disabling the endpoint.
Destination validation rejects credentials in URLs and private, loopback, link-local, reserved, multicast, documentation, and cloud-metadata addresses for IPv4 and IPv6. DNS is resolved again for every attempt, and the connection is pinned to the validated address while retaining the original hostname for TLS verification. Sandbox permits HTTP only for explicit local-development destinations in a local deployment.
429 and 503 responses may include Retry-After; a valid bounded value delays the next attempt without extending delivery beyond the 72-hour retry window. Twenty failed attempts across five events opens the circuit for 15 minutes. A single probe then runs; continued failure increases probe spacing up to six hours.
Operations and secret rotation
The portal can pause, resume, or delete an endpoint, inspect delivery attempts, and manually replay an immutable event. Replay keeps the original event ID and payload but creates a fresh signature and audited attempt. Replay is disabled after a submission enters its paid-history retention archive.
Rotating a signing secret reveals the replacement once. For 24 hours, deliveries include valid signatures from both the new and previous secrets so a receiver can deploy safely; the previous secret then expires automatically.
Delivery diagnostics retain status, duration, time, and a small allowlist of response headers. Failed text-like response snippets are bounded to 4 KB and removed after 30 days; successful response bodies are discarded immediately.