API Webhook Spec Builder

# Webhook Specification

## Endpoint Requirements
- Accept POST requests at your endpoint URL
- Respond with 2xx within 5 seconds
- Return 2xx even if processing asynchronously

## Event Types
- `order.placed`
- `order.shipped`
- `order.cancelled`
- `payment.succeeded`
- `payment.failed`

## Payload Format
```json
{
  "id": "evt_01234567890abcdef",
  "type": "order.placed",
  "created": 1781003474,
  "data": {
    "id": "obj_123",
    "object": "resource"
  }
}
```

## Signature Verification
Header: `X-Webhook-Signature`
Format: `t=<timestamp>,v1=<signature>`

```ts
import { createHmac, timingSafeEqual } from "crypto";

function verifyWebhook(payload: string, header: string, secret: string): boolean {
  const parts = header.split(",").reduce((acc, part) => {
    const [k, v] = part.split("=");
    acc[k] = v;
    return acc;
  }, {} as Record<string, string>);
  const timestamp = parts["t"];
  const sig = parts["v1"];
  // Replay protection: reject if > 5 minutes old
  if (Math.abs(Date.now() / 1000 - parseInt(timestamp)) > 300) return false;
  const expected = createHmac("sha256", secret).update(timestamp + "." + payload).digest("hex");
  return timingSafeEqual(Buffer.from(sig, "hex"), Buffer.from(expected, "hex"));
}
```

## Retry Policy
- Max retries: 3
- Backoff: exponential (1m, 5m, 30m)
- On permanent failure: disable endpoint after 3 consecutive days of failures