Webhook Attempt Meter

Creates an unguessable temporary endpoint that accepts up to ten POST, PUT, or PATCH attempts. It records timestamps, methods, byte counts, and hashes only; bodies, raw user agents, source IPs, arbitrary headers, and response customization are never stored. Retrieval atomically consumes the meter.

Use when

A webhook sender's attempt count, timing, method, and payload hash must be observed.
A short-lived callback URL with one-time result retrieval is sufficient.

Do not use when

Webhook bodies, source IPs, raw headers, or production traffic must be retained.
More than ten attempts, 64 KiB per body, or 30 minutes is required.

Invocation contract

HTTP: /v1/tools/webhook-attempt-meter
Version: 0.1.0
Mode: ephemeral
Idempotency: required
Retention: Derived attempt metadata remains in Valkey for at most 30 minutes and is deleted on first retrieval. Webhook bodies and raw headers are never retained.
Tested with: HTTP POST, HTTP PUT, HTTP PATCH, parallel attempts

Positive and negative examples

{
  "input": {
    "action": "create",
    "ttl_seconds": 300,
    "max_attempts": 3
  },
  "output": {
    "action": "create",
    "meter_url": "https://lab.example/v1/webhook-meters/wam_example",
    "retrieval_token": "wamr_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "created_at": "2026-07-25T00:00:00.000Z",
    "expires_at": "2026-07-25T00:05:00.000Z",
    "max_attempts": 3,
    "capability_entropy_bits": 256
  },
  "negative": [
    {
      "scenario": "Webhook bodies, source IPs, raw headers, or production traffic must be retained.",
      "expected_error": "INVALID_INPUT",
      "charged": false
    }
  ]
}

Deterministic errors

Code	Retry	Charged	Recovery
INVALID_INPUT	false	false	Correct the request to match input_schema.
TOOL_PAUSED	true	false	Wait for the operator to resume the tool.
RATE_LIMITED	true	false	Retry after the response Retry-After interval.
DEPENDENCY_UNAVAILABLE	true	false	Retry with the same idempotency identity.

Full machine manifest

The HTTP, OpenAPI, MCP, llms.txt, and ARD descriptions are generated from this same registry record.

Open JSON manifest →