🪝 Webhooks

Outbound webhooks for workspace events. Receive HTTP POSTs at your endpoint when a patient is created, an appointment is scheduled, a SOAP note is signed, etc.

📡 Event Catalog

* patient.created / patient.updated

* appointment.created / appointment.cancelled / appointment.completed

* soap_note.signed

* claim.submitted / claim.paid / claim.denied

* mail.received

* meeting.started / meeting.ended

* auth.signed_in (admin-only)

* break_glass.invoked (always sent + admin-emailed)

🔐 Signing & SSRF Protection

* Every payload signed with HMAC-SHA256 over the body using OUTBOUND_WEBHOOK_SIGNING_SECRET.

* Signature delivered in X-Synalux-Signature header — verify in your endpoint to reject spoofs.

* Timestamp in X-Synalux-Timestamp header — reject if older than 5 minutes (replay protection).

* HTTPS-only — HTTP endpoints are rejected

* SSRF guard — loopback, RFC1918, link-local, IPv6-ULA, and metadata IPs are blocked

* DNS resolve-and-pin — hostnames are resolved via dns.lookup, all IPs validated against private ranges, then the connection is pinned to the validated IP via a custom undici Agent (prevents DNS rebinding / TOCTOU attacks)

* No redirects followed — redirect: 'manual' treats any 3xx as a failed delivery

* URL credentials blocked — Basic-Auth smuggle via embedded credentials rejected

🔁 Delivery

* Retry policy: exponential backoff (1m, 5m, 30m, 2h, 12h) for non-2xx responses.

* Dead-letter queue after 5 failures — admin gets an email + the failed event surfaces in the workspace inbox.

* Idempotency — every event has a stable event_id you can use as a deduplication key.

* 10s timeout — slow endpoints don't block the dispatcher

* Inbound webhooks for messaging providers (Telegram / WhatsApp / Viber / SMS / Messenger / Instagram) live at /api/v1//webhook — see each provider page.

🏗️ Architecture

``

``

💳 Plans

Available on Advanced+ for outbound; inbound webhooks for messaging providers ship on Standard+.