Integrations

Adapters, credentials and webhooks · secrets never returned in reads (§15.2)

ConnectedConnected
2
Sandbox / simulatorSandbox / simulator
2
Needs attentionNeeds attention
1
Generic REST Commerce
Ecommerce / order
connected

Order lifecycle · refunds · coupon validate

Last sync 13 hours ago
Fake Merchant Providersandbox
Simulator
sandbox

timeout-after-success · duplicate · reorder · partial refund

Last sync 13 hours ago
Email / SMS Pilot
Messaging
connected

DLT templates · opt-out · delivery status

Last sync 13 hours ago
WhatsApp Businesssandbox
Messaging
error

Template approval pending · credentials flagged

Last sync yesterday
Payout Providersandbox
Finance
sandbox

Simulator · unknown/polling semantics under test

Last sync 15 hours ago

Webhook security baseline

HMAC-SHA256 over timestamp.delivery_id.raw_body, constant-time comparison, stale-timestamp rejection beyond 5 min, overlapping keys during rotation, and outbound SSRF guards (reject private/metadata IPs). Retries: 1m · 5m · 30m · 2h · 8h within a 72h window.

replay protectiondead-letter + scoped replaymasked delivery logs