Webhooks

Overview

Webhooks send HTTP notifications to external services as traffic crosses an origin. Use them for analytics, audit trails, alerting, and third-party integrations. Every webhook carries a standard identifying envelope and an optional HMAC-SHA256 signature so the receiver can verify the sender.

Capabilities

• on_request - fired when a request enters the origin
• on_response - fired after the upstream response is observed; the payload adds status and duration_ms
• Per-hook fields: url, method (default POST), secret (HMAC-SHA256 envelope signature), timeout, on_error
• on_error decides whether a failed hook fails the request, logs a warning, or is silently ignored
• Lua callbacks run inline where an HTTP hook is too heavy
• The X-Sbproxy-Event header names the event: on_request, on_response, or alert

Example

Notify an audit sink on every request, without ever blocking traffic:

proxy:
  http_bind_port: 8080

origins:
  "api.example.com":
    action:
      type: proxy
      url: https://test.sbproxy.dev
    on_request:
      - url: https://test.sbproxy.dev/echo
        secret: ${AUDIT_HMAC_SECRET}
        on_error: ignore

Test it:

curl -H "Host: api.example.com" http://localhost:8080/