Delivery log and resources

Every message in both directions is logged — status, attempts, response code, duration, error code and a safe message, the matched secret slot, a capped response excerpt and whether the answer was longer — never a secret, a signature or a credential header.

Models

A replacement must extend the packaged model. Every instant is stored and read as UTC; every table has soft deletes (prune deletes for good). Relations: InboundEndpoint::owner() and deliveries(); InboundDelivery::endpoint(); OutboundEndpoint::owner() and deliveries(); OutboundDelivery::endpoint() and attemptLog(); OutboundAttempt::delivery(). The casts Casts\UtcDateTime, Casts\StoredPayload and Casts\StoredText are public, for reuse on a swapped model.

Querying the log

Webhooks::inbound()->deliveries($endpoint)->where('status', 'failed')->latest('received_at')->paginate();
Webhooks::outbound()->deliveries()->where('status', 'retrying')->get();
Webhooks::outbound()->attempts($delivery);      // every attempt of every series, in order

JSON resources

In RoundlyConsulting\Webhooks\Http\Resources. Instants render as ISO 8601 UTC, enums as their value — never a secret, ciphertext, header value or class name:

use RoundlyConsulting\Webhooks\Http\Resources\InboundDeliveryResource;
use RoundlyConsulting\Webhooks\Http\Resources\InboundEndpointResource;
use RoundlyConsulting\Webhooks\Http\Resources\OutboundAttemptResource;

$endpoints = InboundEndpointResource::collection(Webhooks::for($team)->inbound()->endpoints());   // owner eager-loaded
$delivery = InboundDeliveryResource::make($inboundDelivery)->withPayload();                        // + the sanitized payload
$attempts = OutboundAttemptResource::collection(Webhooks::outbound()->attempts($outboundDelivery));

Return them from your own controllers. The package ships no management routes or UI — only the inbound receiving route — so the API and screens your customers use to manage their endpoints are yours, built on the sub-accessors and these resources. OutboundEndpointResource::redact(string $url) is the URL redaction on its own, for your own views.

The owner reference

An endpoint’s owner renders only through WebhookOwnerResource — {id, type} with the class basename, so no App\Models\Team goes over the wire. Point resources.owner at your own JsonResource to add a name or an avatar; it receives the owner model. Eager-load owner on endpoint collections (endpoints() does) — not loaded, owner renders null.

// config/webhooks.php
'resources' => ['owner' => App\Http\Resources\WebhookOwnerResource::class],

Database schema

Five tables, named by webhooks.tables.*, on MySQL and PostgreSQL. Ids follow primary_key_type, the owner morph follows key_type; foreign keys restrict on delete, so a delivery keeps its endpoint row and an attempt its delivery until retention removes them in order: