Signed outbound webhooks

Only public HTTPS endpoints are accepted. DNS is checked and pinned on every delivery; redirects and private/reserved addresses are blocked. Events contain references, not document or payroll contents. Receivers must verify timestamp/HMAC and deduplicate the event ID.

@csrf @php($uiwebhookendpoints=\App\Support\ListView::rows($endpoints,'webhook_endpoints'))@foreach($uiwebhookendpoints as $e)

{{ $e->name }} · {{ $e->active?'Active':'Disabled' }}

{{ $e->url }}

@if($e->active)
@csrf
@endif
@endforeach

Latest delivery attempts

@php($uiRows1=\App\Support\ListView::rows($deliveries,'webhook_deliveries'))
@forelse($uiRows1 as $d)@empty@endforelse
EventStatusAttemptsHTTPDiagnostic
{{ $d->event_key }}{{ $d->status }}{{ $d->attempts }}{{ $d->http_status ?? '—' }}{{ $d->last_error ?? '—' }}
No webhook deliveries queued.