Delivery & Failures

Webhook delivery is fire-and-forget with a short timeout. Understanding the failure policy will save you from silently disabled endpoints.

How delivery works

When an event fires, Flowsta:

1. Finds every active webhook on the app the event belongs to that is subscribed to that event. Events are never delivered to another app's webhooks.
2. Applies any filters (filters.file_hash on sign.created).
3. Resolves your webhook's hostname again and checks that every address is publicly routable (the same check as at registration, repeated at delivery time to defeat DNS rebinding).
4. Sends a single POST request:
   • Method: POST
   • Content-Type: application/json
   • Headers: X-Flowsta-Signature, X-Flowsta-Event
   • Body: the signed JSON payload

Each delivery attempt has a 10-second timeout. If your endpoint doesn't return headers within 10 seconds, Flowsta aborts the request and records it as a failure.

Retry policy

There is no retry. Each event is delivered once. If your endpoint is down, returns a non-2xx status, or times out, that event is lost.

We recommend:

• Making your handler fast (acknowledge and queue work).
• Treating webhooks as a nice-to-have signal rather than the source of truth.
• Reconciling state periodically against the REST API for critical data.

Automatic disable

To protect your endpoint and our infrastructure, Flowsta tracks a failure_count per webhook.

• Every non-2xx response, network error, or timeout increments the count. So does a delivery that is blocked before sending because the hostname failed to resolve or resolved to a private, loopback, or link-local address.
• A successful 2xx response resets the count to 0.
• After 10 consecutive failures, the webhook's active flag is set to false and Flowsta stops sending events to it.

Re-enabling a disabled webhook

PUT to the webhook with { "active": true }:

curl -X PUT "https://auth-api.flowsta.com/api/v1/webhooks/<id>?app_id=<app-uuid>" \
  -H "Authorization: Bearer <your-developer-token>" \
  -H "Content-Type: application/json" \
  -d '{"active": true}'

This resets failure_count to 0 and resumes delivery on the next matching event.

Monitoring

GET /api/v1/webhooks?app_id=<uuid> returns failure_count, last_triggered_at, and active for each webhook (plus events, filters, and created_at). A non-zero failure_count is a warning; active: false means you're currently receiving nothing. The time of the last failure is recorded but not returned.

{
  "webhooks": [
    {
      "id": "3f9c2a4e-7b1d-4e8a-9c0f-5d6e7a8b9c0d",
      "url": "https://yourapp.com/hooks/flowsta",
      "events": ["oauth.authorized", "oauth.token.revoked"],
      "filters": {},
      "active": true,
      "failure_count": 0,
      "last_triggered_at": "2026-04-13T14:22:00Z",
      "created_at": "2026-04-13T10:00:00Z"
    }
  ]
}

Rate limits

Creating a webhook (POST /api/v1/webhooks) is limited to 30 requests per minute per client. GET, PUT, and DELETE carry no rate limit.

Webhook delivery is not rate-limited on our end - if your app signs ten files in a second through the REST endpoint, we'll attempt ten deliveries. Make sure your endpoint can handle bursts.

Tier limits

Webhooks are counted per organization, across all apps you own.

Tier	Webhooks per org
Free	0 (not available)
Spark	10
Pro	100
Enterprise	Unlimited

Attempting to exceed the limit returns 402 Payment Required (error: "limit_reached"; on the Free tier error: "tier_required").