Artisan commands
| Command | Does |
|---|---|
webhooks:install | Publishes webhooks-config, webhooks-migrations and sentinel-migrations; prints the next steps. |
webhooks:doctor {--json} | Checks the setup; exit 1 on an error; --json prints the findings as a JSON array. |
webhooks:retry | The sweep: due, parked and lost outbound deliveries (at most outbound.sweep_batch per run), dead workers’ attempts, inbound deliveries stored but never queued. |
webhooks:prune {--dry-run} | Retention, and deleted endpoints nothing points at. |
webhooks:rotate-secret {inbound|outbound} {endpoint} {--grace=seconds} | Rotates and prints the new secret once. |
webhooks:redeliver {msg_…} | Redelivers one outbound delivery. |
webhooks:redeliver --endpoint={id} {--since=date} {--cancelled} | After an outage: every failed (with --cancelled, also cancelled) delivery of the endpoint created since the date; prints how many were queued and skipped. |
webhooks:replay {delivery} | Replays an inbound delivery by its public id. |
webhooks:endpoints {--owner=morph-class:id} | Lists inbound and outbound endpoints — never a secret, a header or a full outbound URL (the host only). |
webhooks:enable {inbound|outbound} {endpoint} | Enables an endpoint again (outbound: the failure counter restarts). |
webhooks:ping {endpoint} | Queues a webhook.ping test event to an outbound endpoint. |
webhooks:make-scheme {recipe=blank} {name?} {--force} | Writes a signature-scheme class into app/Webhooks/Schemes from the github, stripe or blank recipe; refuses to overwrite without --force. |
Schedule
With schedule.enabled (on) the provider schedules webhooks:retry (schedule.retry: everyMinute, everyTwoMinutes or everyFiveMinutes) and webhooks:prune (schedule.prune: hourly, daily or weekly), both withoutOverlapping()->onOneServer(), skipped while the tables are missing. Run Laravel’s scheduler — throttled and long-delayed deliveries move only through the sweep. With the schedule off, run webhooks:retry yourself.
webhooks:doctor
| Check | Level | Meaning |
|---|---|---|
config | error | The configuration reads (schemes, handlers, sanitizer). |
sync_queue | warning | The queue connection is sync — processing would run in the request. |
retry_after | error | The connection’s retry_after is not longer than DeliverWebhook’s timeout. |
handler_retry_after | error | The connection’s retry_after is not longer than inbound.handler.timeout. |
max_delay_over_driver_limit | error | An SQS connection with queue.max_delay over 900 s. |
schedule_disabled | warning | schedule.enabled is off — run webhooks:retry yourself. |
rate_limit_store | warning | The http-client-rate-limits store is in-memory with a real queue — the outbound throttle is per process. |
limiter_store_volatile | warning | The inbound limiters’ cache store is array with a real queue. |
idempotency_store_volatile | error | Sentinel’s idempotency store is an array cache — no dedupe across processes. |
idempotency_table | error | Sentinel’s idempotency table is missing (database store). |
curl | error | ext-curl or CURLOPT_RESOLVE is missing. |
ssrf_disabled | warning | The SSRF guard is off. |
http_in_production | warning | Outbound http allowed in production. |
tables | error | The webhooks tables are missing. |
unknown_scheme · unknown_handler | error | An endpoint uses one (detail: the endpoint id). |
rfc9421_id_unsigned | warning | An RFC 9421 endpoint whose profile does not cover its delivery id header. |
rfc9421_no_key | warning | An RFC 9421 endpoint with no Sentinel key bound to it. |
rfc9421_nonce_store | error | Sentinel’s nonce store does not implement InspectsNonces — deferred verification cannot run. |
rfc9421_profile_weak | warning | An RFC 9421 profile turns require_nonce or require_content_digest off. |
sweep_stalled | error | Deliveries due for over 10 minutes are still waiting — webhooks:retry is not running. |
php artisan webhooks:doctor --json
# [{"level":"warning","check":"schedule_disabled","message":"The schedule is off …","detail":null}]Each finding is a DoctorFinding (level, check, detail, message()); the --json array carries level, check, message and detail, ready for monitoring. Without --json the command prints one line per finding, or No problems found., and exits 1 when any finding is an error.
php artisan about
php artisan about # section "Webhooks"The Webhooks section shows the route prefix (or OFF), the queue connection and queues, the schemes, the handler count, the SSRF guard ON or OFF, https only or http + https, and the retry formula — no secret, URL or header value.
Show your open-source love
This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.
More ways to support, including cryptoBy donating, you agree to our donation terms.
Want this built into your product?
We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.