Action Integrity

Connectors: Stripe and Webhook

The Stripe connector (restricted keys) and the Webhook connector contract: execute, status, signatures and idempotency.

A connector is how Audon reads provider context and executes an action. Each one is read_only (the action audit) or execute (live actions). Secrets are envelope-encrypted and never shown again. Execute mode, and replacing a Stripe key, need a signed-in person.

Stripe

Stripe’s REST API with a restricted key (rk_live_… or rk_test_…). A secret key (sk_…) is refused: it can do everything in your account, and a restricted key limits Audon to the permissions an action needs.

Action	Stripe object	Write permission
`refund.create`	Refund on a charge or payment intent	Refunds
`credit.create`	Customer balance transaction	Customers
`discount.create`	Single-use coupon, optionally applied to a subscription	Coupons (and Subscriptions to apply it)
`subscription.cancel`	Cancel now or at period end	Subscriptions
`subscription.update`	Price, quantity, cancel at period end	Subscriptions

Read access to charges, refunds, customers, coupons and subscriptions gives the business rules their context (amount captured, already refunded, disputes, subscription state). The action audit needs read access only.
Health check: Audon probes reads, and write permissions with ids that can’t exist (403 means no permission; 400 or 404 means the permission is there). Nothing is created. A read-only connector warns you when its key can write.
Idempotency: every write carries Idempotency-Key: audon_<action id>_<attempt> and metadata[audon_action_id] / metadata[audon_attempt], which is how reconciliation finds an Unknown action later.
Verification: after a 2xx, Audon re-reads the object before it reports completed.

Webhook: your endpoint executes

For any system without a built-in connector (an order system, a billing tool, an internal service), Audon sends the approved action to your endpoint, signed, with an idempotency key, and asks your status endpoint when an outcome is unclear.

Execute request

httpPOST <your url>

POST /audon/actions HTTP/1.1
Content-Type: application/json
Idempotency-Key: audon_act_8Rk4…_1
x-audon-action-id: act_8Rk4…
x-audon-signature: t=1793611323,v1=5f2c…

{ "id": "act_8Rk4…", "type": "order.cancel", "attempt": 1, "idempotency_key": "audon_act_8Rk4…_1",
  "agent": "customer-support-agent", "resource": "order_8812", "customer": "cus_S8812k",
  "amount_minor": "45000", "currency": "USD", "params": {} }

The signature is v1 = hex(HMAC-SHA256(secret, "<t>.<raw body>")). Check it and the timestamp before you act.

Your answer

You return	Audon records
`2xx { "status": "completed" \| "failed" \| "pending", "external_id"?, "message"? }`	That status (`pending` = executing)
4xx	`failed` (not done, safe to retry)
5xx, 409, a redirect, a timeout, or a 2xx without a status	`unknown`, then reconciliation

Treat a repeated Idempotency-Key as the same action

Your endpoint must deduplicate on the key: a second request with the same key returns the first result and does nothing new.

Status endpoint

httpGET <status url>

GET /audon/status?idempotency_key=audon_act_8Rk4…_1&action_id=act_8Rk4… HTTP/1.1
x-audon-signature: t=1793611353,v1=…        # signed over "<t>.<path?query>"

200 { "status": "completed" | "failed" | "pending" | "not_found", "external_id"?: "…" }
404 → not_found

Health check and limits

Health checks send POST <url> with { "type": "audon.ping" } and x-audon-probe: 1. Answer 2xx without executing anything.
https on port 443 to public IP addresses only, checked again at connect time (safe against DNS rebinding). No redirects. Timeout 1–30 s, default 10 s.

Sample data

Demo organizations have synthetic Stripe and Webhook connectors and can’t hold real credentials.