Webhook ingestion
- Verify the
X-ThreeTone-Signatureheader before processing payloads - Store raw event payloads for replay and audit purposes
- Make downstream handlers idempotent by event ID or call ID
- Return
200quickly and process heavier work asynchronously
Docs automation
- Keep canonical examples in
/examples - Regenerate docs metadata on every PR
- Run live-doc drift checks on a schedule
- Treat placeholder phrases and stale hostnames as CI failures