Callback Security Rules

Asynchronous tasks deliver terminal-state results via webhook_url. The URL must be a publicly accessible HTTPS address.

URL validation

Rule	Description
Protocol	Must use HTTPS
Forbidden addresses	localhost, 127.0.0.1, private network addresses, loopback addresses, internal domains
Data format	The server sends a compact terminal-state notification object as POST JSON; it does not contain the full task result
Failure handling	The callback retry strategy is determined by the final engineering implementation

Callback request body

Once the task reaches a terminal state, the server sends a single POST JSON callback to webhook_url. The body is a compact terminal-state notification object that only signals task completion; it does not include full fields such as the result URL.

{
  "TaskID": "<task_id>",
  "TenantID": "<tenant_id>",
  "Status": "SUCCESS",
  "CallbackURL": "https://example.com/webhook"
}

Field	Type	Description
`TaskID`	string	Task ID; use it to call the task query endpoint to obtain the full result
`TenantID`	string	Tenant ID
`Status`	string	Terminal state of the task; possible values: `SUCCESS`, `FAILED`
`CallbackURL`	string	The `webhook_url` this callback was delivered to