A destination is disabled automatically after 50 consecutive failures, or immediately if it answers 410 Gone. Recovering clears the counter and replays whatever died while it was down.

Inbound sources verify the provider's own signature over the raw request body before anything enters the pipeline. Paste the ingest URL and secret into the provider's webhook settings.

Deliveries that exhausted their retry schedule. Fix the destination, then replay — the original event id is preserved, so a consumer that dedupes on webhook-id will not double-process.

Keys are never stored — only a scrypt hash and the visible prefix. That is why a key cannot be shown again after creation: lost keys are replaced, not recovered. Revocation takes effect within 60 seconds.

Roles are ranks, not lists: viewer reads, developer operates endpoints and replays, admin holds keys and people, owner holds the organisation. A role change takes effect within 60 seconds, everywhere.