Webhooks-as-a-Service

Webhooks-as-a-Service (WaaS) lets you offer a complete webhook experience to your platform's customers without building the infrastructure yourself. You define your event types, publish events via API, and Zyphr handles delivery, retries, monitoring, and an embeddable management portal.

Already using Zyphr for notifications?

If you're looking to receive events from Zyphr's own services (email delivered, push failed, user created, etc.), see Webhooks instead. This page is about powering webhooks for your own platform's customers.

How It Differs from Zyphr Webhooks

	Zyphr Webhooks	Webhooks-as-a-Service
Purpose	Receive events from Zyphr services	Power webhook delivery for your customers
Event types	Zyphr-defined (email, push, auth)	You define your own event types
Endpoints	You manage your own endpoints	Your customers manage their endpoints
Who receives events	Your backend	Your customers' backends
Multi-tenant	Single workspace	Per-tenant isolation

Architecture Overview

Your Platform → Zyphr WaaS API → Delivery Queue → Customer Endpoints
                     ↑                    ↓
              Event Types            Retries, Circuit
              Endpoints              Breakers, DLQ
              Deliveries             Rate Limiting

Key Concepts

• Application — A WaaS application represents your platform. Each workspace can have multiple applications.
• Event Type — A named event your platform publishes (e.g., order.created, invoice.paid).
• Endpoint — A customer's webhook URL, scoped to a tenant. Each endpoint subscribes to specific event types.
• Tenant — Your customer, identified by a tenant_id you assign.
• Delivery — A single attempt to deliver an event payload to an endpoint.

Quick Start

1. Create an Application

Via Dashboard

1. Navigate to Webhooks-as-a-Service → Configure in the sidebar
2. Click Create Application
3. Enter a Name, Slug (URL-safe identifier), and optional Description
4. Click Create

Via API

curl -X POST https://api.zyphr.dev/v1/waas/applications \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Platform",
    "slug": "my-platform",
    "description": "Webhook delivery for My Platform"
  }'

2. Register Event Types

Via Dashboard

1. Click on your application from the list to open the detail view
2. On the Event Types tab, click Register Event Type
3. Fill in the Event Type (e.g., order.created), Name, Category, and optionally an Example Payload (JSON)
4. Click Create

Via API

curl -X POST https://api.zyphr.dev/v1/waas/applications/{app_id}/event-types \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "event_type": "order.created",
    "name": "Order Created",
    "description": "Fired when a new order is placed",
    "category": "orders",
    "example_payload": {
      "order_id": "ord_123",
      "total": 99.99,
      "currency": "USD"
    }
  }'

3. Create an Endpoint for a Tenant

Via Dashboard

1. In your application detail view, go to the Endpoints tab
2. Click Add Endpoint
3. Enter the Tenant ID (your customer's identifier), URL, and select which Events to subscribe to
4. Click Create
5. The endpoint's signing secret is shown once — copy and store it securely

Via API

curl -X POST https://api.zyphr.dev/v1/waas/applications/{app_id}/endpoints \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "tenant_id": "tenant_abc",
    "url": "https://customer.example.com/webhooks",
    "events": ["order.created", "order.updated"]
  }'

The response includes a secret for HMAC signature verification. Store it securely — it won't be shown again.

4. Publish Events

When something happens in your platform, publish an event.

Via Dashboard (Test)

1. In your application detail view, go to the Publish tab
2. Select an Event Type from the dropdown
3. Enter a Tenant ID
4. Enter the event Data as JSON (pre-filled with the event type's example payload)
5. Optionally set an Idempotency Key
6. Click Publish Event
7. View the result: event ID, matched endpoints, and deliveries created

tip

The Dashboard publish feature is designed for testing. In production, publish events via the API from your backend.

Via API

curl -X POST https://api.zyphr.dev/v1/waas/applications/{app_id}/events \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "event_type": "order.created",
    "tenant_id": "tenant_abc",
    "data": {
      "order_id": "ord_456",
      "total": 149.99,
      "currency": "USD",
      "items": [{"sku": "WIDGET-1", "qty": 3}]
    },
    "idempotency_key": "order-456-created"
  }'

Zyphr finds all endpoints subscribed to order.created for tenant_abc, creates delivery records, and queues them for delivery.

5. Batch Publish

Publish up to 100 events in a single request (API only — Starter plan and above):

curl -X POST https://api.zyphr.dev/v1/waas/applications/{app_id}/events/batch \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "events": [
      { "event_type": "order.created", "tenant_id": "tenant_abc", "data": {...} },
      { "event_type": "invoice.paid", "tenant_id": "tenant_xyz", "data": {...} }
    ]
  }'

Delivery Mechanics

WaaS uses the same battle-tested delivery infrastructure as Zyphr's platform webhooks:

• Automatic retries with exponential backoff (default: 6 attempts over 24 hours)
• Circuit breaker per endpoint — trips after consecutive failures, auto-heals
• Rate limiting per endpoint to prevent overwhelming customer servers
• Dead Letter Queue for deliveries that exhaust all retries
• HMAC-SHA256 signatures on every delivery for verification
• Delivery deduplication to prevent double-delivery

Retry Policy

The default retry intervals are: 1 min, 5 min, 30 min, 2 hours, 12 hours, 24 hours.

You can customize the retry policy per endpoint:

{
  "retry_policy": {
    "max_attempts": 4,
    "intervals": [30, 300, 3600, 86400]
  }
}

Signature Verification

Every delivery includes these headers for verification:

webhook-id: msg_abc123
webhook-timestamp: 1709654400
webhook-signature: v1,base64signature...

Your customers verify signatures using:

const crypto = require('crypto');

function verifySignature(payload, headers, secret) {
  const msgId = headers['webhook-id'];
  const timestamp = headers['webhook-timestamp'];
  const signature = headers['webhook-signature'];

  const toSign = `${msgId}.${timestamp}.${payload}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(toSign)
    .digest('base64');

  return signature === `v1,${expected}`;
}

Embeddable Portal

Generate a portal token to embed a webhook management UI in your application:

curl -X POST https://api.zyphr.dev/v1/waas/applications/{app_id}/portal/token \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "tenant_id": "tenant_abc",
    "allowed_event_types": ["order.created", "order.updated"],
    "expires_in": 3600,
    "theme": { "mode": "dark", "accent": "#6366f1" }
  }'

The portal token authenticates your customer's access to the WaaS Portal API (/v1/waas-portal/), where they can manage their own endpoints, view delivery logs, and retry failed deliveries.

Plan Limits

Feature	Free	Starter	Pro	Scale	Enterprise
Applications	1	3	10	50	Unlimited
Event types per app	5	25	100	500	Unlimited
Endpoints	10	100	1,000	10,000	Unlimited
Events/month	1,000	25,000	250,000	2,500,000	Unlimited
Batch publish	-	✓	✓	✓	✓
Portal	-	✓	✓	✓	✓
Transformations	-	-	✓	✓	✓

Dashboard

You can manage Webhooks-as-a-Service entirely from the Zyphr dashboard. Navigate to Webhooks-as-a-Service → Configure in the sidebar.

Applications List

The main page shows all your WaaS applications with status, slug, and creation date. From here you can:

• Create new applications
• Edit application name, description, and status
• Delete applications (removes all associated event types, endpoints, and delivery logs)
• Click an application name to open the detail view

The main page also shows a usage bar displaying how many applications you've used out of your plan limit.

Application Detail

Click any application to access a tabbed detail view:

Tab	Description
Event Types	Register, edit, and delete custom event types. Set categories and example payloads.
Endpoints	Create and manage tenant endpoints. Filter by tenant ID. View subscribed events.
Deliveries	View delivery history and logs. Filter by tenant, event type, or status. Retry failed or exhausted deliveries.
Publish	Send test events to verify your configuration. Select event type, enter tenant ID and JSON payload.

Embedded Portal

Let your customers manage their own webhook endpoints with an embeddable portal. Available as a React component or iFrame.

See Embedded Portal for setup instructions.

Next Steps

• Embedded Portal — Embed webhook management in your app
• API Reference — Full Webhooks-as-a-Service API documentation