01What does a consumer register — one firehose or filtered subscriptions?
Filtered: an endpoint subscribes to event types; the platform fans out only what was asked for — nobody wants every event.
Premium preview
Webhook
Design a webhook delivery platform (Stripe-webhooks-style) that reliably delivers event notifications to thousands of third-party consumer endpoints under retry, ordering, and security constraints.
00
Practice checkpoints
The requirements are open as a taste. From the numbers onward, the full guide opens in the app.
- 01Clarify scope
- 02Requirements + scale
- 03API + data modelUnlocks in the app
- 04Draw architectureUnlocks in the app
- 05Deep diveUnlocks in the app
- 06Trade-off decisionUnlocks in the app
01
Requirements that shape the design
Do not only state requirements. Ask for them. Each card pairs the design constraint with a clarification question you can say out loud before drawing the architecture.
Functional requirements
02What delivery guarantee do we sell, honestly?
At-least-once with duplicates and reordering possible — stated in the docs as the contract, with event ids for dedup and re-fetch endpoints for truth.
03How does a consumer know a delivery is really from us?
HMAC signature over timestamp + payload with a per-endpoint secret; the timestamp bounds the replay window, and secret rotation is supported.
04The consumer is down for six hours — what happens?
Retries with exponential backoff + jitter across a bounded schedule (hours to days); exhausted deliveries dead-letter with one-click replay.
05Can consumers see what we tried to send?
Full delivery history per endpoint — attempts, response codes, latencies — plus manual redelivery; debuggability is half the product.
06One endpoint 500s on everything, forever — do we keep trying?
No: per-endpoint circuit breaking pauses delivery, notifies the owner, and resumes on probe success — a dead endpoint cannot consume fleet capacity.
Out of scopeEvent schema design of the source domain (payments, repos, etc.) · Consumer-side business logic (we cover what a SAFE consumer must implement) · Streaming replacements (Kafka-to-customer) — different product
Non-functional requirements
01What isolates consumers from each other?
Per-endpoint queues with per-endpoint concurrency caps: a consumer answering in 30 s ties up its own lane only.
02A region-wide consumer outage recovers — what hits them?
A controlled drain, not an avalanche: backoff schedules spread retries, and resume-after-circuit ramps rather than floods.
03What consumer behavior must the delivery fleet survive?
Everything: 30-second hangs (timeouts), infinite redirects (no follow), 10 GB responses (read caps), TLS renegotiation games — the fetcher is armored.
04How does a publisher know their events are arriving?
Per-endpoint dashboards: success rate, latency, retry depth, circuit state — deliverability is a product surface, not an internal metric.
05Can an event payload change shape?
Only additively within a version — consumers pin payload versions exactly like API versions; breaking a webhook parser is breaking an API.
Keep asking — the interview is a conversation
Real interviews probe far more than a tidy list. These are the scope questions that separate candidates who interrogate the problem from those who recite it.
- What delivery guarantee do we document — and do consumers understand at-least-once?
- What is the retry schedule and total retry horizon?
- How do consumers verify authenticity — and rotate secrets safely?
- What does the platform do about chronically broken endpoints?
- What must a CORRECT consumer implement (dedup, fast ack, async processing)?
01
Unlock the full playbook for Webhook
Numbers, architecture diagram, API and data model, deep dives, expected topics, self-check, whiteboard starter, and common mistakes unlock inside the app.
Numbers that force architecture decisions
Locked in the app
Architecture path
Locked in the app
API and data model
Locked in the app
Deep dive directions
Locked in the app
+Series