Webhooks

Deliver job, worker, queue, workflow, and predicate events to HTTP endpoints. Deliveries are HMAC-SHA256 signed, retried with backoff, and persisted across restarts.

const hook = queue.webhooks.create({
  url: "https://hooks.example.com/jobs",
  events: ["job.dead", "job.completed", "worker.offline"], // any of the 29 wire names — omit for all
  secret: process.env.WEBHOOK_SECRET,     // signs X-Flexiq-Signature: sha256=...
  taskFilter: ["send_email"],             // optional — only screens task-bearing events
});

queue.webhooks.list();
queue.webhooks.delete(hook.id);

Deliveries for non-job events — worker, queue, workflow, and predicate — carry no job identity; their payload matches the shapes documented on the Events page instead of OutcomeEvent. A subscription's taskFilter only screens events that carry a task name (job.* and predicate.*) — worker, queue, and workflow events always deliver regardless of taskFilter.

Deliveries fire from the worker process (where events originate). Verify the signature on your endpoint by HMAC-ing the raw body with the shared secret.

Destinations are screened by an SSRF guard: loopback, private, link-local, and cloud-metadata targets are rejected at registration and re-checked before every attempt, and redirects are not followed. Set FLEXIQ_WEBHOOKS_ALLOW_PRIVATE=1 when developing against a local endpoint.

Delivery log

queue.webhooks.deliveries(id) returns the most recent attempt-chains for a webhook (bounded, newest last):

for (const delivery of queue.webhooks.deliveries(hook.id)) {
  console.log(delivery.status, delivery.responseCode, delivery.attempts);
}