Zintara webhook HTTPS endpoint requirements and rejected URLs

Define the decision

The reviewed webhook transport rejects local and private network destinations, URL credentials, fragments and non-443 explicit ports. It validates resolved addresses when connecting and does not follow redirects. A localhost development listener therefore cannot be used directly.

Work through the procedure

1. Prepare a public HTTPS receiver with a valid certificate.
2. Configure the final path rather than a redirecting short URL.
3. Confirm DNS resolves only to permitted public addresses.
4. Keep authentication secrets out of the URL.
5. Use the application’s test delivery against a controlled receiver and inspect both sides.

Worked example

The following is a synthetic example for this procedure, not a customer result or performance benchmark.

Acceptable shape: https://hooks.example.com/zintara
Rejected shape: http://hooks.example.com/zintara
Rejected shape: https://localhost/hook
Rejected shape: https://hooks.example.com:8443/hook
Example domain is illustrative and must be replaced.

Read the result

A URL passing creation validation can still fail at delivery because DNS, TLS or the receiver changed. A 301 response is not followed to another endpoint, so configure the final destination directly.

Check before moving on

1. Check the receiver responds without an interactive login.
2. Validate signatures even though transport uses HTTPS.

Limits and next action

The client’s current overall timeout is ten seconds. Persist work quickly and process it asynchronously; do not depend on a long synchronous business operation completing within the delivery request.

Source: Zintara product context