Best Practices

Recommended Patterns

1. Idempotency: Use eventId to detect duplicate deliveries
2. Signature Verification: Always verify HMAC signature before processing
3. Asynchronous Processing: Return HTTP 200 quickly, then process asynchronously
4. Filter by Status: Only process webhooks where assessmentStatus = "ASSESSED"
5. Return 200 for business logic issues: Unknown references, duplicate events - always 200
6. Use Retry-After when rate-limited: Return 429 + Retry-After to control retry timing
7. Monitoring: Monitor endpoint uptime and alert on delivery failures