Production Hosting

This page describes the hosting requirements for running your Engine webhook service in production. Your Engine must meet these requirements to pass verification and operate reliably in public production communities.

PolySwarm does not mandate specific vendors or tooling, you can choose the hosting approach that fits your organisation. The requirements below describe what must be true regardless of where you run it.

Requirements

Publicly Accessible over HTTPS

Your webhook endpoint must be reachable from the public internet using HTTPS.

• The webhook URL must use a fully qualified domain name (FQDN)
• The URL may include a path
• TLS certificates must be valid and kept up to date

Rate Limit

In the PolySwarm UI, you can set a daily rate limit for a webhook. Your hosting must be able to sustain that rate limit.

If your Engine cannot keep up, it may:

• Fail to accept webhooks
• Time out frequently
• Respond too late to participate in rewards

Engines that repeatedly fail to respond may be marked Failed and stop receiving bounties. Recovery usually requires fixes plus a new verification request.

Sufficient Bandwidth (File Engines)

Engines that process file artifacts may download significant volumes of data, bounded by your configured rate limit. Insufficient bandwidth can cause:

• Delayed artifact downloads
• Late assertions (late assertions may not participate in rewards)
• Webhook request failures under load

Ensure your hosting provides enough bandwidth for your expected daily volume and concurrency.

Concurrency

Your webhook server must not block on scanning.

Minimum expectations:

• Validate signature and enqueue work
• Return 202 Accepted quickly
• Perform analysis in worker processes
• Enforce timeouts on any external tools

Monitoring and Logging

At minimum, you should be able to observe:

• Webhook received and validated
• Bounty queued for processing
• Analysis completed (verdict and timing)
• Assertion posted successfully (or error details)

This reduces verification friction and improves time to recover when issues occur.

Migrating from a Development Endpoint

If you used a temporary endpoint (for example ngrok) during development testing, switch to your production endpoint before requesting verification.

A safe migration approach:

1. Create a new webhook in the PolySwarm UI pointing to the production endpoint.
2. Attach the new webhook to your Engine.
3. Test in the Development Community using the production endpoint.
4. Remove or disable the old webhook once the new one is stable.

Webhooks may be treated as immutable configuration objects, so plan for creating a new webhook rather than editing an existing one.