API Reference AshHooks v#2.0.2

Webhooks for Ash Framework — inbound (receive, verify, dedup → domain events) and outbound (sign, deliver, retry, track).

Endpoint body_reader that caches the raw, pre-parser request bytes for signature verification.

Drives one durable outbound delivery through signing, HTTP, and result persistence. It uses your resource modules and configured HTTP adapter. AshHooks.Worker adds an Oban trigger; this driver also works without Oban.

The outbound fanout driver: one event → every matching subscription's endpoint → a durable per-endpoint delivery row (+ an enqueue handoff), with per-endpoint isolation — the outbound twin of AshHooks.Ingress.

Configures an Ash resource as an outbound webhook destination, including its enable/disable state and references to signing secrets.

A reference to a consumer-held secret — never the secret itself.

An outbound webhook destination URL with registration-time validation.

Splode error hierarchy for ash_hooks.

The invalid error class — the webhook input or its verification failed.

An inbound webhook's signature did not verify under the provider's scheme.

The webhook payload does not have the shape the provider expects.

The signing secret for an inbound webhook's provider is unconfigured or unavailable. The caller verifies nothing and does not run the handler.

The timestamp carried by a windowed provider's signature falls outside the allowed replay window.

The payload's event type is not one the provider knows.

The unknown error class — unrecognized failures inside ash_hooks.

An error ash_hooks did not recognize.

An outbound event: its identity, type, exact payload bytes, and optional context.

HTTP adapter contract for outbound delivery.

The default AshHooks.Http adapter: HTTP/1.1 over :gen_tcp and :ssl, with bounded response collection and one operation deadline.

iPAddress Subject-Alternative-Name matching for the literal-IP https floor (ADR-0009's TLS posture): a destination addressed by IP literal has no hostname for RFC 6125 to check, so the peer certificate must carry the exact IP in its iPAddress SAN — chain validation alone would let ANY publicly-trusted cert authenticate the peer.

An AshHooks.Http adapter built on OTP's :httpc.

Configuration for one inbound webhook declaration.

Turns the consumer's resource into the inbound webhook ledger — the durable deduplication record used by AshHooks.Ingress.

Plans and applies adoption of provider-defined inbound identities.

A decoded inbound webhook body, stored as a JSON object or array.

Accessors for a resource's webhooks declarations, read via Spark.Dsl.Extension (the ash_age pattern — no generated getter in this spark version).

The inbound pipeline driver: verify → ingest → claim → handle → mark, over a ledger resource carrying the AshHooks.InboundDelivery extension.

The legacy HMAC webhook envelope for receivers using the :legacy or :dual signing modes.

Configuration for one outbound declaration in the AshHooks DSL.

Builds the versioned, opaque identifiers stored in outbound delivery rows.

Turns the consumer's resource into the outbound delivery ledger: a durable, deduplicated obligation recording that an event must be delivered to an endpoint (the outbound twin of AshHooks.InboundDelivery). Sends remain at-least-once, and receivers deduplicate retries by webhook id.

Complete, metadata-derived primary-key handling for AshHooks ledgers.

Behavior for inbound webhook providers.

Verifies ComplyCube signatures and parses webhook events.

Typed event echoed by AshHooks.Provider.ComplyCube.handle_event/2.

Verifies HubSpot v3 webhook signatures and parses event batches.

Typed event echoed by AshHooks.Provider.HubSpotV3.handle_event/2.

Reference provider for tests and examples: HMAC-SHA256 over the raw body via the default implementation, event type from payload["type"], and an echoing typed event.

Typed event echoed by AshHooks.Provider.Mock.handle_event/2.

Standard Webhooks signing and verification for v1 (HMAC-SHA256) and v1a (ed25519), over msg_id.timestamp.payload.

Destination validation for outbound webhooks.

Turns the consumer's resource into the outbound Subscription — which events go to which endpoint, and with which signature envelope.

Lifecycle events for ingress, queue admission, and outbound delivery.

The tenancy contract resolver: every public entry family resolves the resources it touches BEFORE any data access.

The host-injected Oban worker (ADR-0004): the consuming app defines one module, and the Oban beam compiles only where Oban exists. This macro expands use Oban.Worker inside the host's compilation, so the package itself never references a loaded Oban module and compiles Oban-free (the CI no-optional leg's proof).

Installs ash_hooks into a host application