Polling

The alternative to an inbound HTTPS URL. Connect the custom platform without a target URL and Hijinks holds every outbound event — the same envelopes, with the same ids and sequence numbers, that it would otherwise POST — for 24 hours. The bridge fetches them here, oldest first, and passes the next cursor back as after on its next poll. A cursor never skips an event: an event still being written when you poll is served after it, never before. Events older than 24 hours are gone; a page whose after is that old says so with gap: true.

Poll every few seconds (the reference bridge polls every 2). When hasMore is true, poll again at once. An endpoint with a target URL has its events pushed, never held, and is answered 403 — so before setting one, drain what is held with a last poll: events not fetched by then are never pushed.

Starting without a cursor. after=latest answers no events and the newest cursor: the bridge starts from now. Use it on a first start and whenever the saved cursor is lost; leaving after out instead replays everything held, up to 24 hours of games.

Catching up. After downtime a page can hold a backlog. Drop every event past its expiresAt. Of several message.updates for one message.id, apply only the one with the highest sequence. An update for a message whose create you dropped is dropped with it.

When your chat refuses a message. Do not advance past a create (message.create, dm.create) your chat refused: poll the same after again and retry it until it succeeds or expires — handled events repeat, and you dedupe them on id. A refused message.update or message.ephemeral can be dropped: the next update supersedes it, and a reply is soon stale anyway.

Health. A bridge that stops polling while events wait for it shows as failing in the dashboard after 5 minutes, and the workspace's owner is emailed once per outage.

Signing the request. Hijinks-Signature as for a push, computed over the query string exactly as sent — after=41&limit=100, or the empty string with no query — in place of a body: v1=HMAC-SHA256(secret, "<t>.<query string>").

Verifying the response. The 200 carries Hijinks-Signature over the exact response bytes, in the push format (one v1= per active secret during a rotation). Verify it before acting on any event.

The checks and their order are those of POST /hooks/{workspaceId} (the IP and workspace rate limits included; a poll counts against both), then the query parameters (400 naming the parameter). Every poll counts as a delivery in the dashboard's health, and "Send test event" queues a ping and reports whether the bridge polled within the last minute.