Sume webhook Send test vs Redeliver: only one replays a real job

Use Redeliver to replay a real job and Send test to check that your endpoint verifies a signature. Sume's webhooks page says they are two different actions: Send test posts a dummy signed webhook.test payload to a URL you type and never replays a real job, while Redeliver re-posts the job's real terminal event with a fresh timestamp and signature.

Side by side

Both need a verifier that accepts only a valid signature, and a non-empty secret.

How to use them

Deploy the receiver, press Send test, and confirm that your code returns 2xx for webhook.test without looking for a job_id. When a real delivery is missed, call Redeliver for that job. Treat job_id as the idempotency key on your side, so a second delivery of the same event does nothing.

Delivery is an optimization, not the only recovery path: after ten refused attempts the job still reached its real terminal state, and the status polls remain available. The webhooks page has the details, including the 10-second timeout per attempt.

A receiver that handles both

Your handler should accept both shapes. For webhook.test return 2xx and do nothing else. For job events, store the event durably, keyed by job_id, then return 2xx. If you see the same job_id and event again, return 2xx without repeating work.

Verify the signature before parsing: the timestamp must be inside your tolerance window, and the HMAC is computed over <timestamp>.<raw_body>. During secret rotation the header can carry several sume-v1= entries and any match is valid.

• Verify first, parse second.
• Refuse an empty secret.
• Dedupe on job_id.