Known Gaps / Roadmap
Documented honestly so you can plan around them.
| Area | Today | Planned |
|---|---|---|
| Inbound webhook (bridge → ZenSpace via zenspace_webhook URL) | 404 — not implemented | Will be added; use REST API in the meantime |
| Webhook signing | Plain POST, no HMAC | HMAC with per-connection secret |
| Webhook retries | None — fire and forget | Retry with backoff + dead-letter |
| Webhook delivery log | None | Queryable log endpoint |
| Backend dedupe on metadata.external_event_id | None — bridge must dedupe | Uniqueness constraint or Idempotency-Key header |
| GET /api/third-party/{connection_id}/bookings | None | Planned |
| Rate limits | Not enforced; 429 reserved | Per-key quotas |