> ## Documentation Index
> Fetch the complete documentation index at: https://docs.politicalcomms.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Retry Policy

> Four attempts with exponential backoff. Best practices for making handlers idempotent.

If your endpoint doesn't return a `2xx` response within 10 seconds, we retry on an exponential backoff schedule.

## Retry schedule

| Attempt   | Delay                                          |
| --------- | ---------------------------------------------- |
| Attempt 1 | Immediate                                      |
| Attempt 2 | 4 seconds after first failure                  |
| Attempt 3 | 16 seconds after second failure                |
| Attempt 4 | 64 seconds after third failure (final attempt) |

After **4 failed attempts** the webhook is marked as failed. You can manually retry from the webhook deliveries page in the dashboard.

## Best practices

<AccordionGroup>
  <Accordion title="Return 200 within 10 seconds" icon="bolt">
    Process asynchronously if needed. Queue the event for background processing and return `200` immediately. This prevents retries on slow handlers.
  </Accordion>

  <Accordion title="Always validate the HMAC signature before processing" icon="shield-check">
    See [Signature Validation](/api-reference/webhooks/signature-validation).
  </Accordion>

  <Accordion title="Use event_id to deduplicate" icon="copy">
    Rare but possible - under network failure conditions you could receive the same event twice. Store processed `event_id`s and skip duplicates.
  </Accordion>

  <Accordion title="Log failures and monitor endpoint health" icon="chart-line">
    Set up alerting on failed webhook deliveries. Mintlify's audit log + your own application logs together give you full traceability.
  </Accordion>

  <Accordion title="Use HTTPS endpoints (required in production)" icon="lock">
    HTTPS is enforced for all production webhook endpoints. Self-signed certs are not accepted - use a real CA-issued cert.
  </Accordion>

  <Accordion title="Rotate secrets periodically (every 90 days recommended)" icon="rotate">
    From the dashboard, regenerate the signing secret on each endpoint. Update your application's environment variable, then verify a test webhook validates with the new secret before relying on it.
  </Accordion>
</AccordionGroup>