What you should do
- Return 2xx as soon as you have durably enqueued the event (e.g. written to a database or your own queue). Do not wait for downstream side-effects to finish.
- Be idempotent. Use
X-Notealy-Delivery-Idas a deduplication key. The same event can arrive more than once. - Stay under 25 seconds. Long-running work belongs in a background worker, not in the webhook handler.