Events

In RoundlyConsulting\Webhooks\Events, all final readonly; none carries a secret, a signature or a raw body. Write your audit log from them:

Unknown keys fire nothing, so a stranger cannot spam your listeners; a duplicate fires nothing.

Once per attempt — WebhookReceived

WebhookReceived fires on every attempt of a run — a handler that throws is retried, and the retry fires it again. A listener that must act once per delivery checks the attempt:

Event::listen(function (WebhookReceived $event): void {
    if (! $event->webhook->isFirstAttempt()) {
        return;   // a retry of a run whose handler threw
    }

    Cache::increment('webhooks.received.'.$event->webhook->type);
});

Queued listeners

WebhookProcessingFailed, DeliverySucceeded, DeliveryFailed, EndpointDisabled and EndpointSecretRotated use SerializesModels: a ShouldQueue listener receives the models as they are when it runs. WebhookReceived carries the sanitized payload, and a queued listener on it would write that payload into your queue store unencrypted, around payloads.encrypt. Keep WebhookReceived listeners synchronous, or queue only the delivery id and load the delivery in the job:

Event::listen(function (WebhookReceived $event): void {
    SyncInvoice::dispatch($event->webhook->deliveryId);   // the job loads it again
});

// in SyncInvoice::handle()
$delivery = Webhooks::inbound()->deliveries()->where('public_id', $this->deliveryId)->firstOrFail();