Skip to content
ashton.aschenbrener
All projects

active project

Webhook Replay Lab

A non-AI systems project that proves backend reliability chops. Receives, stores, and replays webhooks with full audit history. Built in Next.js + Postgres with route handlers and server-side validation.

Next.jsTypeScriptPostgresTailwindRoute handlersServer-side validation
Live demoGitHubArchitectureCase notes

Problem

What it solves.

Webhook integrations fail silently. Most teams discover misses days later. The Replay Lab gives every event an audit trail and a one-click replay so failures stop being mysteries.

What I built

The specific parts I implemented.

›Webhook intake endpoint with signature validation
›Postgres-backed event store
›Replay & retry logic with backoff
›Audit log + per-event timeline UI

What I owned

My responsibility surface.

Backend architecture

Data model

Reliability semantics

UI

Architecture

How data moves through the system.

POSTpersistreplayExternal source(Stripe / GitHub / etc.)Intake route+ signature checkReplay queuePostgres(events, attempts)Next.js UI(timeline + replay)Audit log

Screenshots

What the system looks like.

Dashboard with live metrics showing total events, failure rate, dead letter count, and replay activityEvents inbox listing every captured webhook with status, signature check, and duplicate countDead letter queue for events that exhausted retry attempts and need manual review

Data model

What entities the system tracks.

WebhookEvent
- id
- source
- received_at
- headers
- payload
- signature_ok
- status
DeliveryAttempt
- id
- event_id
- attempt_no
- status_code
- error
- started_at
- finished_at
AuditEntry
- id
- event_id
- action
- actor
- created_at
- notes

Failure handling

What happens when something breaks.

Signature mismatch

Persist event with signature_ok=false, do not dispatch downstream, alert in audit log.

Downstream 5xx

Mark attempt failed; schedule exponential backoff retry up to N attempts.

Duplicate delivery (same id)

Idempotent insert; record duplicate as no-op attempt.

Verification

How I tested or evaluated it.

Eval harness

Cases, expected, actual.

Well-formed event flows through intake + replay

pass
Input
Simulate a Stripe payment.succeeded webhook with a valid HMAC signature.
Expected
Event persisted, attempt logged, replay triggers delivery.
Actual
Event persisted with signature_ok=true; replay triggered 1 attempt with 200 response.

Signature mismatch blocks downstream dispatch

pass
Input
Same event with forged HMAC signature.
Expected
Event persisted with signature_ok=false, no downstream dispatch.
Actual
Signature flagged as invalid; event marked dead without dispatch; audit entry created.

Duplicate event idempotency

pass
Input
Deliver the same webhook id twice in succession.
Expected
Only one event record created; second delivery recorded as a no-op duplicate.
Actual
Duplicate detected via id constraint; second attempt recorded as no-op without duplicate event.

Next improvements

Known gaps & next moves.