Architecture
What is Webhook?
Also known as: HTTP callback, reverse API
A webhook is a reverse API call: instead of you polling a service for changes, the service sends an HTTP POST to a URL you registered the moment an event happens.
Polling asks anything new? a thousand times to catch one event. A webhook inverts it — you register a URL with Stripe, GitHub or Slack, and when a payment clears or an issue opens, they POST a JSON payload to you within seconds. It's cheaper and faster, but the burden shifts: your endpoint must be publicly reachable, respond fast (most providers time out in seconds and retry), verify the signature they send, and tolerate duplicates, because at-least-once delivery is the norm.
Two rules keep webhook-driven agents sane. Verify signatures — an unauthenticated webhook URL is a public button anyone can press to start your agent. And make the handler idempotent, since the same event will arrive twice sooner or later and send the invoice should not run twice. Beyond that, treat the payload as untrusted content: it's a common carrier for prompt injection into an agent that reads it. In Velaris that reading is bounded by per-run scoped credentials and approval on destructive tools.