Skip to main content

Versioning and the public API

This package follows Semantic Versioning, and it tells you exactly which classes that promise covers.

Every class named below lives under the root namespace Pushery\Webhooks\ — so Server\PendingWebhook is Pushery\Webhooks\Server\PendingWebhook. That root changed in 2.0.0; see Upgrading from 1.x.

The public API is​

  • WebhookManager and the Webhooks facade, and WebhookEvent
  • Testing\WebhookFake, which Webhooks::fake() switches on in your own tests, and the Testing\FakedWebhook it records
  • Sending: Server\PendingWebhook and Server\Facades\WebhookSender, the backoff contract, the queued CallWebhookJob, the transactional Server\Outbox, and the delivery value objects the events carry
  • Receiving: Client\WebhookProcessor, Client\WebhookConfig, Client\InboundMessage and its Client\PayloadFormat, Client\Jobs\ProcessWebhookJob, Client\Http\RawBody, the profile / response contracts, and the strategy contracts a config can point at — Client\Dedupe\DedupeKeyResolver, Client\EventTypeResolver and Client\Tenancy\InboundTenantResolver with the Client\Tenancy\InboundTenant it returns, and Client\Tenancy\InboundTenantScope, which runs the package's work on a tenant's calls in its context
  • Signing: the Core\Signing\SignatureScheme contract, every shipped scheme, and SecretSet / WebhookMessage / SignatureHeaders / VerificationResult
  • Platform\Feed\EventFeedPage, the page of an endpoint's event feed that Webhooks::feed() returns
  • Core\Http\GuardedFetch, which fetches an outside URL under the SSRF guard, and the Core\Http\FetchedResponse it hands back
  • The SSRF guard contract, the models, the enums and exceptions (named one by one, with their stored values), and all the events
  • Host-implemented seams the shipped screens ask: Platform\Transform\PayloadTransformer, Dashboard\DashboardScope, Dashboard\DashboardTimezoneResolver (the zone the dashboard renders timestamps in, when one fixed value is not enough), and Platform\Support\ReadableEndpoints (which endpoints a reader may see beyond the ones they own, for a host that shares them), Platform\Support\ReplayableEndpoints and Platform\Support\RegistrationLimit (whether a tenant may register one more endpoint by your own allowance)
  • What a published migration copy calls: the database guards Database\DatabaseRequirement and Database\PostgresRequirement, Database\Dialect\Dialect, Database\OwnerKeyType, Support\TableLookup, Support\WebhookConnection and Support\MigrationLocks, and the webhooks.database.connection key
  • Support\EnvFlag and Support\EnvLimit, which a published copy of the config calls to read a switch that protects something and a numeric limit held to its floor
  • The service providers — including their static ignoreMigrations(), one per layer, which is how a host takes the migrations over — the Livewire component aliases, the published views and migrations, the config tree, and the publish tags

Everything else is @internal​

The delivery pipeline, the response classifier, the config reader, the SSRF resolver internals, the dashboard's metric objects, the listeners — and may change in a minor release.

Those classes carry an @internal docblock tag, your IDE and static analyzer will say so, and a test in the package's repository fails if a class outside the list above ever loses the tag.

Bind to the list; leave the rest to the engine.