Webhook

A webhook inverts polling: instead of asking "has anything changed", you register a URL and get told. The cost is that you now operate a public endpoint that anyone can send anything to.

That endpoint needs signature verification so you know the payload came from who it claims, replay protection so an old valid payload cannot be re-sent, and idempotent handling so a duplicate delivery does not duplicate the effect.

Senders retry aggressively and treat a slow response as a failure, so a webhook handler should acknowledge quickly and do the real work afterwards.

Why it matters

Webhooks are the standard way systems tell each other things, and an unverified webhook endpoint is an unauthenticated write path into your application.