WebhookConfig

@rotorsoft/act-root

---

@rotorsoft/act-root / act-http/src/webhook / WebhookConfig

Type Alias: WebhookConfig<TEvents>

WebhookConfig<TEvents> = object

Defined in: libs/act-http/src/webhook/types.ts:33

Configuration for webhook.

Type Parameters

TEvents

TEvents extends Schemas = Schemas

Event schemas; resolvers receive the typed committed event.

Properties

body?

readonly optional body?: WebhookBody | ((event) => WebhookBody)

Defined in: libs/act-http/src/webhook/types.ts:51

Request body. Static plain data (object, array, string) or a per-event function returning the same. Strings are sent as-is; anything else is JSON-serialized. Defaults to the committed event itself.

---

fetch?

readonly optional fetch?: typeof fetch

Defined in: libs/act-http/src/webhook/types.ts:70

Injection point for tests. Defaults to global fetch.

---

headers?

readonly optional headers?: WebhookResolver<TEvents, Record<string, string>>

Defined in: libs/act-http/src/webhook/types.ts:44

Headers to send. Resolver may return a record per event. The Content-Type: application/json and Idempotency-Key headers are applied automatically; both can be overridden by returning a header with the same name (case-insensitive).

---

idempotencyKey?

readonly optional idempotencyKey?: (event) => string | null

Defined in: libs/act-http/src/webhook/types.ts:64

Override for the auto-generated Idempotency-Key. By default, the helper sends event.id (the immutable, monotonic event identifier). Return a string to override; return null to skip the header entirely.

Parameters

event

Committed<TEvents, keyof TEvents>

Returns

string | null

---

method?

readonly optional method?: "POST" | "PUT" | "PATCH" | "DELETE"

Defined in: libs/act-http/src/webhook/types.ts:37

HTTP method. Defaults to "POST".

---

secret?

readonly optional secret?: string

Defined in: libs/act-http/src/webhook/types.ts:88

HMAC-SHA256 signing key. When set, the webhook helper attaches two headers to every request:

• X-Webhook-Signature: sha256=<hex> — HMAC of ${timestamp}.${body} (body is the final serialized payload)
• X-Webhook-Timestamp: <unix-seconds>

Pair with verifyWebhook from @rotorsoft/act-http/receiver on the receiving side. When undefined, no signature headers are added — back-compat with consumers that don't need signing.

Callers can override either header by returning it from the headers resolver (case-insensitive), the same way the Idempotency-Key and Content-Type defaults yield to caller intent.

---

timeoutMs?

readonly optional timeoutMs?: number

Defined in: libs/act-http/src/webhook/types.ts:58

Per-request timeout in milliseconds. Defaults to 5000. The handler throws after the timeout via AbortController.

---

url

readonly url: WebhookResolver<TEvents, string>

Defined in: libs/act-http/src/webhook/types.ts:35

Target URL — static string or per-event function.