Feature
Signed webhooks
Organizations subscribe a URL to audit event types and get HMAC-signed deliveries with retries.
Each delivery carries X-Workloom-Signature (HMAC-SHA256 over the timestamp and body), X-Workloom-Event, X-Workloom-Delivery, X-Workloom-Timestamp and X-Workloom-Schema-Version.
Failed deliveries retry after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours, then go dead. You can send a test delivery and list past deliveries through the API.
More features
All features →- 01
Validate the manifest and its trust gates
`wl validate` checks workloom.workspace.json against the schema, then runs the trust gates over a render plan and lists what they would block.
- 02
Deterministic render plans
See every file each provider will get, with its projection policy, ownership and write mode, before anything is written.
- 03
Sync with ownership checks
`wl sync` writes only the projections the trust gate allows, atomically, and changes or removes only files Workloom owns.