Also known as: HTTP callback · event notification
A webhook is an HTTP request sent automatically from one system to another when an event occurs, allowing the receiver to react immediately rather than repeatedly polling for changes.
Webhooks invert the usual API relationship: the provider becomes the client and the consumer must operate a reachable endpoint. That endpoint is public infrastructure and must be treated as such.
Two security requirements are frequently missed. Payloads must be signature-verified, since anyone who learns the URL can post to it; and receivers should be careful about outbound requests derived from webhook data, a common source of server-side request forgery.
API
An API (application programming interface) is a defined contract through which one piece of software provides functionality or data to another, specifying available operations, expected inputs, and returned outputs.
REST
REST (Representational State Transfer) is an architectural style for networked applications in which resources are identified by URLs and manipulated through standard HTTP methods, with each request carrying all context needed to process it.
Idempotency
An operation is idempotent if performing it multiple times produces the same result as performing it once, which allows a client to safely retry a request without risking duplicate side effects.
Rate Limiting
Rate limiting restricts how many requests a client may make within a time window, protecting a service from overload, abuse, and runaway costs while ensuring capacity remains available to other users.