Webhooks
Security and retention
How secrets are stored, how targets are checked, and how long deliveries are kept.
Security
- Secrets at rest. Signing secrets and custom header values are stored encrypted. Header names stay readable. The API never returns header values, and returns the secret only to admins who ask for it.
- Private targets are refused. Endpoints must be
httpsand may not resolve to private, loopback, link-local (including cloud metadata) or reserved addresses. This is checked when you save and again at every connection, against the address actually connected to, so DNS rebinding cannot get round it. - No credentials in the URL. Use a custom header instead.
- Signed deliveries. Verify every one. See Verify a webhook.
Retention
A delivery is a log of processing, kept for at least a year.
| What | Kept for |
|---|---|
| The payload sent, the person's id and the response body | 30 days, then purged, because they name the person |
| The summary: event, Consent ID, endpoint host, status, attempts, times and error | A year or more |
A purged delivery cannot be resent.
Erasure
When an erasure request is resolved, the deliveries about that person are purged along with the rest of their data. Their summaries stay. The data_request.status_changed event for it carries no email.
Retention periods are a product reading of DPDP Rules 2025, not legal advice. Verify with counsel.