Webhook connector for AI agent actions.
For an order system, billing tool or internal service without a built-in connector, Audon sends each approved action to your endpoint, signed with HMAC-SHA256 and carrying an idempotency key. When the outcome is unclear, it asks your status endpoint before anything is retried.
Actions it runs. Each checked by built-in rules before your own policies.
Create a refund
refund.create
- Payment (or Shopify order) exists, is paid and is in the action currency
- Amount ≤ captured (received) amount − already refunded − refunds in flight
- Payment is not disputed
- No refund of the same amount on the same payment or order in the duplicate window
Issue a customer credit
credit.create
- Customer exists and is not deleted
- Customer balance currency matches
- No credit of the same amount to the same customer in the duplicate window
Grant a discount
discount.create
- A percent discount states the value at risk as amount
- No discount of the same amount for the same customer in the duplicate window
Cancel a subscription
subscription.cancel
- Subscription exists and is not already canceled
Change a subscription
subscription.update
- Subscription exists and is active or trialing
- The change differs from the current state
Cancel an order
order.cancel
- Order exists and is not already cancelled (Shopify)
- A cancel with refund is refused on a disputed payment
- No cancel of the same order in flight or completed
The contract. Your endpoint executes; Audon signs and checks.
- Request
- POST to your URL with the action as JSON, an Idempotency-Key header and an x-audon-signature header.
- Signature
- v1 = hex(HMAC-SHA256(secret, "<t>.<raw body>")). Check it and the timestamp before you act.
- Your answer
- A 2xx with status completed, failed or pending; a 4xx means failed and safe to retry; anything unclear is Unknown.
- Status endpoint
- Audon asks it, signed, when an outcome is Unknown, before anything is retried.
Good to know.
- Your endpoint must deduplicate on the Idempotency-Key: a repeat returns the first result and does nothing new.
- https on port 443 to public IP addresses only, checked again at connect time. No redirects. Timeout 1–30 seconds.
- A 5xx, 409, redirect, timeout or a 2xx without a status is recorded as Unknown and reconciled.
Questions about Webhook.
Which actions can AI agents run in Webhook through Audon?
Create a refund, issue a customer credit, grant a discount, cancel a subscription, change a subscription and cancel an order. Each is checked against built-in business rules and your own policies before it runs.
Who executes the action?
Your endpoint. Audon checks the action first, then sends it signed and with an idempotency key; your endpoint must treat a repeated key as the same action.
What happens when the outcome is unclear?
The action is Unknown and is never retried blindly. Audon looks it up at the provider first, starting after 30 seconds and backing off, and only allows a retry once the outcome is known.
What else do I have to change?
Remove the agent’s direct access to the same API (for example a Stripe secret key in its environment), or it can bypass the checks.
Last updated