Command reference

The commands

Command	What it does
webhooks:preflight	Check that the database the persistent layers store their tables in is supported, that the schema agrees with the configuration, and — while the receiving layer is on — that every inbound client config can actually verify a delivery. Prints the connection it resolved.
webhooks:partition-maintenance	Provision upcoming delivery-log partitions and drop those past the retention window.
webhooks:revoke-rotated-secrets	Clear every endpoint secret whose rotation window has closed, so it can no longer sign or verify.
webhooks:refresh-endpoint-health	Recompute and cache the health score of every active endpoint.
webhooks:refresh-metrics	Refresh the hourly delivery-metrics materialized view the dashboard reads.
webhooks:egress-ips	Print the published egress-IP allowlist consumers should add to their firewall.
webhooks:asyncapi	Generate an AsyncAPI 3.0 document from the event catalog.
webhooks:ed25519-keygen	Generate an Ed25519 keypair for asymmetric signing (v1a).
webhooks:prune-orphaned-payloads	Delete offloaded payload objects no delivery-log or call-log row still references.
webhooks:import-calls	Backfill the webhook_calls log from an inbound-webhook table you used before this package (idempotent).

Options

webhooks:preflight
    --connection=      The database connection to check (defaults to the application default)

webhooks:egress-ips
    --format=json      Output format — json (default), txt or md

webhooks:asyncapi [path]
    path               File to write the document to; omit to print to stdout
    --format=json      Output format — json (default) or yaml (yaml requires symfony/yaml)
    --title=           Document title (defaults to the app name)
    --doc-version=     Document version (default 1.0.0)

webhooks:prune-orphaned-payloads
    --disk=            The Storage disk to sweep (defaults to the Server offload disk)
    --dry-run          Report what would be deleted without deleting anything

webhooks:import-calls
    --source=          The value written to the source column. Defaults to each row's own
                       producer-name column; pass this to force one source for every
                       imported row, and to keep two imports apart.
    --from-table=      The table to read from (default webhook_calls)
    --from-connection= The connection that table lives on (defaults to the app default)
    --from-id=id       The source column holding each row's primary key
    --from-source=name The source column naming the producer a row came from
    --from-payload=payload   The source column holding the decoded JSON body
    --from-headers=headers   The source column holding the request headers as JSON
    --from-error=exception   The column recording a failure; its PRESENCE marks the row failed
    --chunk=1000       How many source rows to read per batch (bounds memory on a big backlog)
    --dry-run          Report what would be imported without writing anything

What runs on a schedule

Registered only while webhooks.schedule.enabled is true (the default) — see Scheduled maintenance.

Command	Cadence	Registered by
webhooks:partition-maintenance	daily	the Platform layer
webhooks:revoke-rotated-secrets	hourly, without overlapping	the Platform layer
webhooks:refresh-endpoint-health	platform.health.refresh (default every fifteen minutes), without overlapping	only while platform.health.enabled
webhooks:refresh-metrics	dashboard.metrics.refresh (default every five minutes), without overlapping	the Dashboard layer
model:prune on WebhookCall	daily	the Client layer
model:prune on WebhookServerDelivery	daily	only while server.persistence.enabled

An unknown cadence token falls back to the documented default rather than silently never running.

webhooks:prune-orphaned-payloads is deliberately not auto-scheduled: retention prunes rows, and the offloaded objects are content-addressed, so reclaiming them is a decision you make (a disk lifecycle policy is the other supported route). See Reliability.