Alibaba Cloud EventBridge webhooks

Q: What happens if Alibaba Cloud EventBridge sends the same event twice?

Redeliveries are deduplicated on The CloudEvents id , from the body or ce-id , namespaced per source, so a repeat becomes the same event rather than a second one.

CloudEvents pushed from an EventBridge HTTPS target, authenticated by a header token.

In short

Verification: a constant-time header token.
Deduplication: The CloudEvents id, from the body or ce-id.
Once verified, the event joins your catalogue with the same retries, log and replay as anything you publish yourself.

The contract

Field	Value
Provider key	`alibaba-eventbridge`
Header checked	`x-hookget-token` (also accepted: `Token`, `Authorization: Bearer`)
Scheme	EventBridge cannot HMAC-sign an outgoing event, so the contract is a constant-time comparison of a header token. It is never accepted from the query string.
Deduplicated on	The CloudEvents `id`, from the body or `ce-id`
Event type	The CloudEvents `type`, or `ce-type`, becomes `alibaba.<type>`.

Setting it up

# 1. create a verified source; the secret is shown once
curl -X POST https://api.hookget.com/v1/sources \
  -H "authorization: Bearer $HOOKGET_KEY" \
  -H "content-type: application/json" \
  -d '{"provider":"alibaba-eventbridge","name":"Production"}'

# {"id":"src_…","secret":"whsec_…","ingest_path":"/ingest/src_…"}

Create an HTTPS target on the event rule and set the URL to the ingest URL.
Add a request header x-hookget-token with the source secret as its value.
Send a test event; it appears in the event log within a second.

Worth knowing. Put the token in a header, never in the URL. EventBridge will happily send a query parameter, and a query parameter ends up in access logs, referrers and browser history.

What you get after verification

The event appears in your log with a namespaced type, so Alibaba Cloud EventBridge traffic never collides with your own.
It fans out to your destinations with the same retry schedule and dead-letter behaviour as any other event.
The source secret rotates with an overlap window, so you can update Alibaba Cloud EventBridge at your own pace.
Each inbound source is rate limited on its own, so a busy provider cannot exhaust your publish budget.

Questions

How do I verify a Alibaba Cloud EventBridge webhook?

EventBridge cannot HMAC-sign an outgoing event, so the contract is a constant-time comparison of a header token. It is never accepted from the query string. With HookGet you do not implement it: the source is created with a secret, and every request is checked against x-hookget-token (also accepted: Token, Authorization: Bearer) before the event exists.

What happens if Alibaba Cloud EventBridge sends the same event twice?

Redeliveries are deduplicated on The CloudEvents id, from the body or ce-id, namespaced per source, so a repeat becomes the same event rather than a second one.

What if verification fails?

The request is refused with 401 and nothing enters the pipeline. The rejection is logged on our side as a signal worth watching; the caller learns nothing beyond the status.