Documentation / Platform glossary / Webhook
A webhook is an HTTP callback: when something happens in one system, it sends a request to a URL the subscriber registered in advance. It inverts the usual direction of integration — instead of an application polling for changes, the source pushes them as they occur.
The subscriber registers an endpoint and the events it wants. When a matching event occurs, the source sends an HTTP POST carrying a payload describing it, and the subscriber responds with a success status to acknowledge receipt.
Three properties determine whether a webhook integration is reliable in production.
Delivery is at-least-once, not exactly-once. Network failures and timeouts mean a sender that cannot confirm receipt will retry, so the same event may arrive twice. Receivers need to be idempotent — usually by recording a processed event identifier and discarding repeats.
Ordering is not guaranteed. Retries and parallel delivery mean events can arrive out of sequence. Payloads that carry a timestamp or version let a receiver reject stale updates rather than apply them.
The endpoint is publicly reachable, so authenticity must be verified. The standard approach is a signature computed over the payload with a shared secret, which the receiver recomputes and compares. Without verification, anyone who learns the URL can submit fabricated events.
Failed deliveries are typically retried with exponential backoff, and persistently failing endpoints are eventually suspended.
Webhooks remove polling latency and its wasted requests, which matters for workflows where a delay of minutes is a business problem. They also shift responsibility: the receiver must be available, fast enough to acknowledge before timeout, and safe to call more than once.
The most common production failure is doing substantive work before acknowledging. Long processing inside the request causes timeouts, which causes retries, which causes duplicate work.
QueryTek uses event notifications so integrations react to activity within their tenant without polling. Payloads are signed for verification and carry a correlation reference for support. Endpoint registration and signature verification detail is provided through authenticated onboarding.
