Setup
Cloud Owners save one public HTTPS webhook URL in Settings → API. Localhost and non-public URLs are rejected. The UI stores a single endpoint and always subscribes to all activity actions (*); there is no event picker, delivery log, or replay.
Payload
JSON: event (the internal activity action, such as client.created or reminder.sent), workspace_id, occurred_at, properties. Headers: X-Duvento-Event and X-Duvento-Signature (HMAC-SHA256 of the body with the endpoint secret). The secret is stored and shown in the UI in plaintext — treat it as a credential.
Event names follow the activity log; they are not a versioned public schema.
Retries
Delivery runs after the database commit. The HTTP client retries up to 3 times (8-second timeout). Failures are written to application logs. There is no in-app replay, and delivery is not guaranteed.