Integrations & Webhooks

Bi-directional webhook engine, REST API gateway, and external sync pipeline.

The Integrations module provides the foundation for connecting Alegor-powered applications to external SaaS, ERPs, accounting systems, and payment providers with enterprise reliability standards.

Capabilities

Core Functional Capabilities

✓ Outbound webhook dispatch with HMAC-SHA256 signature verification

✓ Configurable retry backoffs (exponential backoff with jitter)

✓ Inbound webhook signature validator and replay attack protection

✓ Dead Letter Queue (DLQ) with manual inspection and replay controls

✓ Rate limiting and token bucket throttling per external endpoint

✓ Payload transformation and schema mapping pipelines

Contracts

Public Interface Contracts

Other modules and domain action classes interact exclusively via these typed PHP contracts.

interface WebhookDispatcherInterface

interface WebhookValidatorInterface

interface DeadLetterQueueManagerInterface

interface ExternalSyncEngineInterface

Reactivity

Dispatched Domain Events

Dispatched upon state mutation for downstream audit recording, webhook firing, and asynchronous notifications.

⚡ WebhookSent

⚡ WebhookDelivered

⚡ WebhookFailedPermanent

⚡ InboundWebhookReceived

Customization

Extension Points

• Connectors for standard business ERPs (Fortnox, Visma, SAP, NetSuite)
• Custom payload serialization and encryption transformers

🛡 Security & Isolation

• HMAC payload signatures prevent spoofing
• Timestamp nonces mitigate replay vulnerabilities
• Encrypted credential storage using AES-256-GCM

Core Entities & Models

WebhookEndpoint (Tenant_id, url, secret, event_types, is_active)
WebhookDelivery (Endpoint_id, event_type, payload, status_code, response_body, attempts)
IntegrationCredential (Tenant_id, provider, client_id, encrypted_tokens)