Provider webhooks

Current behavior

The LiveKit and Stream paths return 202 Accepted and ignore the payload. No event is verified, parsed, persisted, or dispatched. Duplicate delivery and ordering therefore have no observable effect for those two paths.

Endpoints

Response contract

Both paths return the same status and JSON body regardless of the request payload.

curl --include --request POST \
  --header 'Content-Type: application/json' \
  --data '{}' \
  https://api.facoolta.com/webhooks/livekit

# HTTP/2 202
# {"ok":true,"ignored":true}

A provider may treat any 2xx response as successful delivery and remove the event from its retry queue. Because facoolta currently discards it, the event cannot be replayed from this API.

Trigger.dev job completion

The internal Trigger.dev callback requires x-trigger-secret. Its JSON body contains jobId, a status of queued, running, done, or needs_you, and an optional resultSummary of at most 2,000 characters.

Production guidance

• Do not configure business-critical LiveKit or Stream events against their placeholder paths yet.
• Do not trigger access changes, billing, recording, moderation, or notifications from a realtime-provider acknowledgement.
• Keep x-trigger-secret in server-side secret storage and rotate it after suspected exposure.
• Keep provider delivery logs if a temporary test configuration is necessary.
• Wait for documented signature verification, event schemas, idempotency, and replay handling before production use.

For readiness questions, contact support@facoolta.com with the provider name and intended event types. Do not send provider signing secrets.