Use one webhook registration, land the payload in a durable queue, and make every internal consumer acknowledge its own copy. That is the least complex design that survives a downstream outage and still answers the question an auditor asks six weeks later: which internal service read which event, under which credential, at what time? Fan-out is the easy part. The flow fits in one breath. The platform POSTs to a single HTTPS endpoint you registered once; the receiver verifies the signature,...