Story 034: Webhooks

[iagocavalcante]

Summary

As an organizer, I want to configure webhooks, so that external systems are notified of platform events

Blocked by: story-033-rest-api

Acceptance Criteria

1. Webhook Configuration

1. Register Endpoint: Organizer registers webhook URLs that receive notifications for specific events (order placed, order paid, check-in, etc.).
2. Signed Payloads: Webhook payloads are signed so receivers can verify authenticity.

2. Delivery

3. Retry Logic: Failed deliveries are retried with exponential backoff.
4. Delivery History: Delivery history and status (success, failed, pending retry) are visible to the organizer.

Test Plan

Tier 1 — Acceptance Tests

• AC1: Register a webhook URL with selected event types
• AC2: Webhook payloads include a signature header for verification
• AC3: Failed deliveries are retried with exponential backoff
• AC4: View delivery history with status per delivery

Tier 2 — Edge Cases

• Webhook endpoint timeout marks delivery as failed and retries
• Invalid URL registration rejected with validation error
• All retries exhausted shows final failed status
• Webhook scoped to organization (not triggered by other orgs)
• Concurrent events each produce independent deliveries

---

📄 Full spec: spec/elixir-phoenix-migration/10-product/stories/story-034-webhooks.md