Codehooks has written the plainest account of webhook auditing I have read this year. In How to audit whether a webhook was ever received, co-founder Martin starts from the questions that arrive weeks late: did a Stripe event land on the 14th, did a customer’s order ever come through, can an auditor have six months of payment events. If you stored nothing, the answer to all three is “probably, but we can’t prove it.” The gateway log is not enough because retention runs days or weeks rather than years, and because “it records delivery rather than outcome.” The line that carries the post: “Receiving a webhook takes an hour or two. Being able to answer questions about it three weeks later is a different job, and it is the one that tends to get skipped.”
The one number in the piece is arithmetic, not marketing. At 2,000 events a day you accumulate around 730,000 records a year, which the post calls “a lot of rows and not much data.” The advice is concrete and survives without the product attached. Store five things before you process: the provider’s event ID, the event type, your own received timestamp, the full raw payload, and a processing status with the error if it failed. Verify signatures against the raw body, not re-serialized JSON. Check the event ID before doing anything so a retry is harmless, and if double-processing would be expensive, make the downstream operation idempotent on that ID as well. Split storage and acknowledgement from processing so the provider gets its 200 quickly. The company’s webhook-verify package, covering 21 providers under an MIT license, is the one product plug, and it is a fair one.
Every piece of that handler maps to a page in the catalog. The Codehooks provider page lists four API pages. The insertOne and findOneOrNull calls that store the event and check for a duplicate run against the Codehooks Documents API. The enqueue call and the worker that does the processing are the Codehooks Queue API. The onBefore and onAfter hooks the catalog description credits the platform with are documented as Codehooks Events, an AsyncAPI, which is why the event surface described dimension on the Agent Readiness score is lit. The agentic access profile maps 15 operations, 11 of them acting.
The Kin Score is 41.7, developing band. Contract quality carries it at 67.3 and discoverability at 66.7. Operational transparency is 13.2 and contract governance is 13.6. The Agent Readiness score is 20.9, agent-aware, and the unlit dimensions are where the tension lives. Idempotency is unlit. Error semantics is unlit. Reversibility is unlit. Codehooks just published a careful argument for keying every downstream operation on a stable event ID so that a repeat is harmless, and the catalog cannot find that guarantee described anywhere on the company’s own API. The advice is right. It has not yet been applied to the surface that gave it.