What This Extension Adds #

Core DDLS does not support webhooks. DMSI Advanced API adds a full outbound webhook system with delivery logging, retry logic, and HMAC-SHA256 signature verification.

Webhooks Not Firing #

Webhooks are dispatched asynchronously in the background.

Checks to perform:

1. Confirm the webhook endpoint is enabled in the DDLS Developer admin shell under Webhooks.
2. Confirm the event type that should trigger the webhook is included in the endpoint’s subscribed events list.
3. Confirm that WP-Cron is running. On local or low-traffic installations, WP-Cron may not fire. Consider installing Action Scheduler for reliable background delivery.

Viewing Delivery Logs #

Navigate to the webhook endpoint’s detail page in the DDLS Developer admin shell. The delivery log shows each delivery attempt with:

• HTTP status code returned by the receiving server
• Response body (first 1,000 characters)
• Timestamp and attempt number

Use this log to diagnose whether the issue is with the sending side (WordPress not dispatching) or the receiving side (your endpoint returning errors).

Signature Verification Failing #

Each webhook delivery includes an X-DMSI-Signature header with an HMAC-SHA256 signature.

Common mistakes that cause verification failures:

• Computing the HMAC over parsed/re-serialized JSON instead of the raw request body bytes
• Using the wrong key (the signing secret is shown once on endpoint creation; if lost, regenerate it)
• Trimming whitespace from the raw body before computing the HMAC

Correct verification (PHP example):

$raw_body    = file_get_contents('php://input');
$signature   = $_SERVER['HTTP_X_DMSI_SIGNATURE'] ?? '';
$expected    = 'sha256=' . hash_hmac('sha256', $raw_body, $signing_secret);
$is_valid    = hash_equals($expected, $signature);

Delivery Stopped After Repeated Failures #

After 5 consecutive failed delivery attempts, the plugin stops retrying and marks the delivery as permanently failed. The endpoint remains active and will attempt delivery for new events.

Resolution: Fix the issue on your endpoint server, then review the delivery log. For missed events, you may need to re-trigger the business action (for example, re-saving the affected resource) or replay events manually by calling the appropriate REST API endpoints.