Evidence
When a webhook integration breaks, the question is never just "did it fail." It is what arrived, whether the provider signature verified, which routing rule fired and at which version, what each delivery attempt returned, and what fixed it. Switchyard preserves that record as a sanitized, exportable artifact — so it holds up in an incident review, a ticket, or an agent's context.
The problem
A log line shows an outcome. It cannot show the rest of the story.
A log line that says POST /hooks/stripe → 200 does not preserve what the
provider actually sent: the method, path, content type, body size, and body SHA-256
that let you prove which payload you are talking about.
Logs record that an event went somewhere. They do not record which rule matched, which version of the rule set was active at that moment, or which destinations were evaluated and skipped.
A single failure line collapses four retries, their HTTP statuses, their error classes, and their timing into one entry — or scatters them across lines you have to stitch back together by hand.
Raw logs carry headers, cookies, signatures, and payload bodies. Pasting them into a ticket or an agent's context ships secrets. A log line cannot produce a sanitized artifact you can hand to someone else.
The artifact
A receipt is the sanitized record of a single event: what arrived, how it was verified, where it was routed, what happened on each delivery, and how it ended.
exhausted or succeeded.http_server_error, not free-text guesses."sanitized": true and its format version, so a reader knows what kind of document they hold.Sanitization
Receipts are not redacted after the fact. The sensitive material is never in the export to begin with.
Masked fields carry "masked": true with null values — the
reader can see that a field existed and was masked, without any path to its contents.
This is enforced by the server and regression-tested with seeded canaries, so evidence
can go into a ticket, a pull request, or an agent's context without a redaction pass.
Privileged access to an original payload stays in the audited browser flow, outside exports and outside agent reach.
Scope
A receipt records one event. An incident bundle freezes a multi-event story.
One event, from arrival through verification, routing, delivery attempts, and recovery. Export it when the question is about one webhook.
A snapshot of selected events created in one transaction: per-event receipt summaries, routing decisions, delivery timelines with attempt outcomes and error classes, provider verification summaries, an operator note, and an explicit sanitization statement. It never changes after creation; changing the note or the selection means creating a new bundle.
Collaboration
Evidence shares hand a sanitized artifact to someone outside your workspace without handing them anything else.
A share link grants read-only access to one sanitized receipt or incident bundle.
A share token grants nothing else: no workspace access, no raw payloads, no other events, no actions.
Discipline
The evidence states what was observed. Conclusions — human or machine — are labeled separately and verified against the facts.
Switchyard's evidence carries facts: provider verification status, matched routing rules, attempt outcomes, HTTP statuses, error classes. It deliberately avoids speculation. Humans and agents attach their inferences on top, labeled as inferences.
We do not use AI to invent an explanation for missing evidence. We preserve the evidence so humans and machines can reason from the same facts.
Delivery is at least once; duplicates remain possible. Repeats are recorded as duplicate hints in the evidence, not silently merged — and neither you nor an agent should assume otherwise.
For agents
Four CLI commands produce bounded, sanitized JSON an agent can reason over — with credentials structurally absent.
# What arrived — the event record
switchyard event show EVENT --endpoint ENDPOINT --json
# What happened downstream — the delivery record
switchyard delivery show DELIVERY --endpoint ENDPOINT --json
# The whole story in one sanitized machine document
switchyard receipt export EVENT --endpoint ENDPOINT --format json --stdout
# Configured intent, secret-free, to compare against observed behavior
switchyard config export ENDPOINT
Run the agent under a scoped workspace token — for example
events:read deliveries:read deliveries:operate receipts:read — so the API
enforces the boundary regardless of what the agent tries. Do not hand it a personal
token or arbitrary command execution.
When diagnosis points to an action, the follow-up vocabulary is closed and safe — idempotent, audited with principal attribution, and communicated through exit codes:
# Re-send a preserved event to one destination
switchyard event replay EVENT --destination DEST
# Extend an exhausted delivery budget
switchyard delivery retry DELIVERY --endpoint ENDPOINT
# Wait for an outcome instead of polling prose
switchyard delivery wait DELIVERY --endpoint ENDPOINT --until delivered --timeout 60
switchyard events wait ENDPOINT --match 'json.field=value' --timeout 30Samples
Inspect the exact artifact this page describes, in the two formats published here.
Receipts and incident bundles export as JSON, Markdown, and HTML — each at format version 1. The HTML export is self-contained and script-free.
Durability
Evidence is a snapshot, not a live view.
Receipts and incident bundles are versioned snapshots of the record at export or creation time. An incident bundle never changes: event retention may delete the original events without altering the bundle, and deletion by an authorized operator is the only mutation.
Retention cleanup runs delete events according to the retention policy you configure. What a snapshot captured stays captured; what retention removed is gone from the live record — and the evidence says honestly which is which.
Boundaries
Every action on evidence is recorded. Every token means exactly one thing.
The audit history records evidence actions — share created, share revoked, incident bundle created, incident bundle deleted — with bounded metadata: identifiers, truncated titles, counts. Never tokens, and never share URLs.
Possession of a share token grants read-only access to the sanitized artifact it points at, and nothing else. It is not a workspace credential, it does not widen over time, and it stops working the moment it expires or is revoked.
Walk a failed delivery from arrival to recovery, then read exactly what Switchyard does and does not claim.
The demo uses the same sample receipt published on this page — labeled as sample data throughout.