Design Webhook Delivery

Events are written durably (an outbox or a replicated log) before anything is acknowledged, and fanned out into one delivery per subscribed endpoint whose state survives crashes.

Deliveries are scheduled per endpoint with a concurrency cap, a short connect timeout and a circuit breaker, so a slow or dead endpoint holds a bounded number of workers or connections while every other endpoint keeps its latency.

Failed deliveries are rescheduled with exponential backoff and jitter in a durable delay queue, stop after three days, and lead to disabling the endpoint; manual resends reuse the same event id.

Each request carries an HMAC of a timestamp and the body with a per-endpoint secret (supporting rotation, and letting the merchant reject replays), and outgoing requests are blocked from reaching internal addresses (SSRF).

6 billion events times 1.5 endpoints is 9 billion deliveries a month, about 3,500 a second on average and 17,000 at peak; with responses taking up to 10 seconds, the senders need asynchronous I/O for tens of thousands of open connections.

Every functional requirement in the brief is visibly served by something on the board, and the non-functional targets are addressed rather than ignored.

Components are labelled, data flows are drawn as connections between them, and the direction of each flow is unambiguous.