# Outbound webhooks: Standard Webhooks v1

2026-07-20

BioFlow now delivers signed outbound webhooks for contact.created, page.published, sale.paid, and sale.refunded (plus a synchronous endpoint.test event). Deliveries are signed per Standard Webhooks v1, retried on an exponential ladder, and manageable end-to-end over the API: create, test, rotate secrets, list deliveries, resend, and replay.

## Added

- Four event types — contact.created, page.published, sale.paid, sale.refunded — each emitted transactionally with the domain mutation.
- Standard Webhooks v1 signing: webhook-id / webhook-timestamp / webhook-signature headers, HMAC-SHA256, whsec_ secrets, dual-signature rotation overlap.
- Retry ladder: up to 8 attempts over roughly 41 hours (30s, 2m, 10m, 1h, 4h, 12h, 24h) with jitter; only 2xx counts as delivered.
- Failure ladder: 20 consecutive failed deliveries auto-disable the endpoint and notify the workspace owner; re-enable and replay over the API.
- Webhook endpoint management operations on /v1: create (with signed verification event), get, list, update, delete, test, rotate-secret, deliveries, resend, replay.

Back to the changelog: https://getbioflow.com/changelog