Webhooks, events and recovery
Proposed asynchronous notification contracts support signatures, replay protection and controlled retries.
Final sources tied to business decisions
Envelope and verification
eventId, eventType, occurredAt, tenantId, projectId, objectRef, version and correlationId. Illustrative profile: HMAC-SHA256 over timestamp + dot + raw body using X-TR-Timestamp and X-TR-Signature. Secrets remain server-side; verify algorithm/window in the real contract.
Duplicates and ordering
Use constant-time signature comparison, validate timestamp/window, record processed eventIds and check tenant/object version. Acknowledge 2xx after durable receipt; do not assume global ordering. Duplicates must not repeat effects.
Retry and replay
Propose jittered backoff and contractual retry budgets; retry eligible 429/5xx/timeouts, correct permanent 4xx configuration errors. Exhausted budgets enter exception/DLQ handling. Approved replays retain eventId/correlation/history and do not automatically create new billable usage.
Continue the workflow
Two journeys, one records lifecycle
Connect paper and born-digital records through persistent identifiers, policies and evidence.
Read detailsIntegration quickstart
Exercise ingest → job tracking → registration → verification with synthetic data.
Read detailsIntegrity, provenance and evidence
Each evidence type answers a different question; hashes, timestamps and approvals are not interchangeable.
Read detailsStart with a verifiable scope.
Agree record classes, quality criteria, permissions and evidence before scaling.
Plan assessment