Mission 2 · Trustworthy webhook
Accept real events safely and exactly once.
Build a webhook boundary that answers monday.com verification, validates the expected event, persists intent before side effects, and prevents duplicate meetings and duplicate write-back.
Build sequence
- Return the monday.com verification challenge exactly and quickly.
- Validate event shape, board, item, column, action, and the authentication mode available to the integration.
- Derive and persist an idempotency key before meeting creation or CRM mutation.
- Acknowledge promptly, move long work to an asynchronous lane, and retain a durable event ledger.
- Test repeated delivery, missing item ID, wrong column, unsupported status, delayed downstream API, and provider retry.
Required proof
- Challenge verification result and sanitized request contract.
- Duplicate delivery produces one business side effect.
- One failure trace with a useful operator-facing error and correlation ID.
Reference files and sources
Official vendor documentation
Assessment gate
Pass
Pass: replay and concurrency tests demonstrate one durable intent and one external side effect.
Revise
Revise: ordinary requests work but durable persistence, replay defense, or failure evidence is incomplete.
Hard fail
Hard fail: an endpoint trusts arbitrary payloads, logs secrets, or creates duplicate meetings or writes.
Human-reviewed submission
