Webhooks and callbacks

Abi integrations use server-to-server webhooks for asynchronous service events and postMessage callbacks for agreed embedded browser flows.

Webhook handling

1. Register a secure HTTPS endpoint through the webhook operation.
2. Subscribe only to events your integration handles.
3. Authenticate or validate every delivery using the mechanism defined in your partner contract.
4. Return a successful response quickly and move slow work to an asynchronous queue.
5. Make processing idempotent because deliveries can be retried.
6. Log event identifiers and outcomes without logging sensitive payloads.

Use the format-event operation only where your integration contract requires it. The API reference is the source of truth for event names and payload schemas.

Browser callbacks

For embedded experiences, validate the sender origin and accept only documented message types. Browser callbacks must never carry partner credentials.