Delivery endpoint verification, signing, and Push/Pull/Custom modes
Endpoints are push, pull, or custom, with at most ten per owner. Push uses public HTTPS and starts pending_verification. The owner starts a 15-minute challenge; the receiver must echo the challenge to become active. Changing the URL or rotating the secret returns Push to pending and terminalizes queued or in-flight work. Embedded credentials, fragments, and redirects are rejected.
Push sends X-Arinova-Signature using HMAC-SHA256 over "<timestamp>.<body>", plus delivery-ID and event headers. The secret is displayed only when created or rotated; the Agent cannot read it.
Custom is owner-configured: the owner controls the literal-public-HTTPS URL, POST/PUT/PATCH method, header and JSON body templates, and encrypted named secrets. The Agent supplies only the event and payload. Custom sends rendered JSON without the Push envelope or HMAC signature.
Activation makes a real request with a non-persisted sample and needs 2xx under a 15-minute token guard. This proves request acceptance, not ownership or authorization; a required secret is friction. URL or secret changes return Custom to pending and terminalize queued work. Method, header, or body-only changes keep it active but terminalize queued work as endpoint_template_changed.
Pull endpoints have no URL and activate immediately. An Agent can list or get /api/v1/deliveries, then use the idempotent ack route. List, get, and ack all filter by the acting Agent’s explicit endpoint read or write grant plus owner scope. Pull fails closed at 120 requests per 60 seconds per Agent. Platform Agents received no migration grants.
An Official account may bind an owner-matching active verified Push endpoint, never Pull or Custom. URL/secret changes, re-verification, disablement, or rebinding fence captured Official automation runs. Binding does not grant Agent access.
Related actions
Section titled “Related actions”arinova.delivery.list_endpoints, arinova.delivery.send
Also known as
endpoint verification, verification challenge, delivery signature, verify HMAC, push endpoint, pull endpoint, custom endpoint, 驗證端點, 驗簽, 簽章
Build a7f47a5ca54ddcf7806cd48b81ce1b9827042766