Design a backend endpoint that receives webhooks from an external provider and updates internal state.

In production I document which provider fields are authoritative and how signature verification behaves behind proxies and during secret rotation. Rate limits absorb legitimate bursts without disabling provider authentication, and raw payload access is restricted because webhook bodies often contain sensitive data. Reconciliation compares internal state with the provider for events that were missing, delayed, or ended with an ambiguous external result. Replay tooling keeps the original event identity and records operator intent so idempotency remains effective. Metrics cover verification failures, intake latency, duplicates, processing age, ordering gaps, provider retries, and reconciliation repairs. Failure tests crash after durable intake, after the business update, and before acknowledgement to prove no event is lost and no effect is duplicated.