Top 3 Webhooks Interview Questions
Browse 3 real-world technical and behavioral interview questions about Webhooks. Review scenarios, edge cases, and architectural best practices.
You are accepting webhooks from two hundred partners. Threat model the ingestion pipeline - what are you actually defending against, and what does the endpoint have to do before it trusts a payload?
The endpoint is an unauthenticated internet-facing entry point that writes to your core systems, so treat every field as attacker-controlled. Verify an HMAC over the raw body in constant time, reject stale timestamps, deduplicate on event id, bound the body size, and hand off to a queue rather than processing inline.
One of your endpoints takes four minutes to complete. How should the API expose it?
Accept the request, return 202 with the location of an operation resource, and do the work behind a queue. Clients poll that resource or receive a signed callback, and either way the operation id is the contract - one that a callback can reach before the submitter has finished recording it.
A customer's bank shows the money left their account and you have no order. How does your checkout make that impossible, and how do you find the ones that already happened?
Write the order before you call the payment provider and key both with the same idempotency token, so a timeout leaves a record you can resolve. Then reconcile the provider's ledger against your orders daily in both directions, because a lost outcome is silent by default. Use this payment orchestration answer to show the decision, trade-off, and evidence rather than a memorised definition.