{"result":{"depiction_url":null,"edges":{"in_module":{"objects":[{"created":"2026-09-29T13:07:42Z","object_id":{"id":2703,"is_a":["text","documentation","reference","module"],"name":"doc_module_mod_websub","title":"mod_websub","uri":"https:\/\/zotonic.com\/id\/2703"},"seq":1}],"predicate":{"id":333,"is_a":["meta","predicate"],"name":"in_module","title":{"_type":"trans","tr":{"en":"In module"}},"uri":"https:\/\/zotonic.com\/id\/in_module"}},"subject":{"objects":[{"created":"2026-09-29T13:07:42Z","object_id":{"id":2555,"is_a":["categorization","keyword","keyword_information_type"],"name":"zotonic_topic_reference","title":"Reference","uri":"https:\/\/zotonic.com\/id\/2555"},"seq":1},{"created":"2026-09-29T13:07:42Z","object_id":{"id":2565,"is_a":["categorization","keyword","keyword_audience"],"name":"zotonic_topic_integrator","title":"Integrator","uri":"https:\/\/zotonic.com\/id\/2565"},"seq":2},{"created":"2026-09-29T13:07:42Z","object_id":{"id":2592,"is_a":["categorization","keyword","keyword_domain"],"name":"zotonic_topic_authorization_and_access_control","title":"Authorization and access control","uri":"https:\/\/zotonic.com\/id\/2592"},"seq":3},{"created":"2026-09-29T13:07:42Z","object_id":{"id":2599,"is_a":["categorization","keyword","keyword_domain"],"name":"zotonic_topic_api_and_integration","title":"API and integration","uri":"https:\/\/zotonic.com\/id\/2599"},"seq":4},{"created":"2026-09-29T13:07:42Z","object_id":{"id":2601,"is_a":["categorization","keyword","keyword_domain"],"name":"zotonic_topic_export_and_syndication","title":"Export and syndication","uri":"https:\/\/zotonic.com\/id\/2601"},"seq":5},{"created":"2026-09-29T13:07:42Z","object_id":{"id":2626,"is_a":["categorization","keyword","keyword_architecture"],"name":"zotonic_topic_controller","title":"Controller","uri":"https:\/\/zotonic.com\/id\/2626"},"seq":6},{"created":"2026-09-29T13:07:42Z","object_id":{"id":2676,"is_a":["categorization","keyword","keyword_technology"],"name":"zotonic_topic_http","title":"HTTP","uri":"https:\/\/zotonic.com\/id\/2676"},"seq":7}],"predicate":{"id":308,"is_a":["meta","predicate"],"name":"subject","title":{"_type":"trans","tr":{"en":"Keyword"}},"uri":"http:\/\/purl.org\/dc\/elements\/1.1\/subject"}}},"id":2705,"is_a":["text","documentation","reference","controller"],"links":[{"rel":"self","target":"https:\/\/zotonic.com\/.zotonic\/websub\/topic\/2705"},{"rel":"hub","target":"https:\/\/zotonic.com\/.zotonic\/websub"}],"medium":null,"medium_url":null,"name":"doc_controller_controller_websub","page_url":{"en":"https:\/\/zotonic.com\/docs\/2705\/controller_websub","x-default":"https:\/\/zotonic.com\/docs\/2705\/controller_websub"},"preview_url":null,"resource":{"version":19,"pivot_location_lat":null,"title":"controller_websub","is_authoritative":true,"body":"<p>HTTP hub and subscriber callback controller for <code>mod_websub<\/code>.<\/p>\n<h2>Endpoints<\/h2>\n<table class=\"table\"><thead><tr><th>Dispatch<\/th><th>Method<\/th><th>Purpose<\/th><\/tr><\/thead><tbody><tr><td><code>websub<\/code> (<code>\/.zotonic\/websub<\/code>)<\/td><td>POST, form encoded<\/td><td>Request subscription or unsubscription at this site&#39;s hub.<\/td><\/tr><tr><td><code>websub_callback<\/code> (<code>\/.zotonic\/websub\/:token<\/code>)<\/td><td>GET<\/td><td>Confirm pending subscriber intent or receive a denial.<\/td><\/tr><tr><td><code>websub_callback<\/code><\/td><td>POST, JSON<\/td><td>Receive a signed resource-export delivery from a remote hub.<\/td><\/tr><\/tbody><\/table>\n<p>Subscription forms use the standard <code>hub.mode<\/code>, <code>hub.topic<\/code>, <code>hub.callback<\/code>,\noptional <code>hub.secret<\/code>, and optional <code>hub.lease_seconds<\/code> fields. The topic must\nmatch a local resource&#39;s advertised JSON topic URL. Lease seconds are ignored\nfor unsubscription. Accepted requests receive 202 after durable queue admission;\noverload receives 503. Verification and authorization run independently in\n<code>task_verify\/7<\/code>, so accepting a request does not activate the subscription.<\/p>\n<p>The hub checks that the resource is visible to the subscriber and authoritative,\nthen verifies the callback by GET with a random challenge. It activates or removes\nthe subscription only after a successful response with the exact challenge body.\nPrivate subscriptions require explicit HTTP authorization; browser cookies alone\nare insufficient. The worker retains the authentication&#39;s effective group limits.<\/p>\n<p>Subscriber callbacks match the capability token, discovered topic, pending action,\nand verification deadline. Valid intent returns the challenge as plain text with\n<code>nosniff<\/code>; unexpected intent returns 404. A denial stops the matching subscription.\nDelivery accepts resource-export JSON, verifies the configured HMAC signature in\n<code>m_websub:handle_push_notification\/4<\/code>, and queues import work. Invalid signatures\nare ignored locally while the callback can still acknowledge receipt with 2xx.<\/p>\n<p>Outbound callback requests use <code>z_websub_http<\/code> and <code>z_fetch<\/code>, with destination\nchecks and automatic redirects disabled. Callback verification and delivery do\nnot use the initiating user&#39;s OAuth2 credentials. Request admission is deduplicated\nand bounded per site; inbound delivery bodies are limited to 1 MiB.<\/p>\n<p>See <code>mod_websub<\/code> for the complete two-site flow, resource identity versus topic,\nOAuth2 integration, and the open DNS connection-pinning TODO.<\/p>","slug":"controller_websub","is_protected":false,"visible_for":0,"tz":"UTC","language":["en"],"doc_source_hash":"21fa981ae565f11ecc46ad89fda4600b12431f819b8cb3502b870296700350a1","is_featured":false,"content_group_id":{"id":2551,"is_a":["meta","content_group"],"name":"content_group_imported_docs","title":"Imported documentation","uri":"https:\/\/zotonic.com\/id\/content_group_imported_docs"},"category_id":{"id":321,"is_a":["meta","category"],"name":"controller","title":"Controllers","uri":"https:\/\/test.zotonic.com\/id\/321"},"doc_source_path":"apps\/zotonic_mod_websub\/src\/controllers\/controller_websub.erl","publication_start":"2026-09-29T13:07:42Z","github_url":"https:\/\/github.com\/zotonic\/zotonic\/blob\/master\/apps\/zotonic_mod_websub\/src\/controllers\/controller_websub.erl","pivot_location_lng":null,"doc_source_kind":"controller","name":"doc_controller_controller_websub","is_unfindable":false,"is_published":true,"pivot_geocode":null,"created":"2026-09-29T13:07:42Z","uri":null,"doc_status":"current","is_dependent":false,"erlang_app":"zotonic_mod_websub","publication_end":"9999-06-01T00:00:00Z","modifier_id":{"id":1,"is_a":["person"],"name":"administrator","title":"Site Administrator","uri":"https:\/\/zotonic.com\/id\/1"},"privacy":0,"doc_source_commit":"85498256abd162b9bc082d43a90c995844fd4408\n","erlang_module":"controller_websub","creator_id":{"id":1,"is_a":["person"],"name":"administrator","title":"Site Administrator","uri":"https:\/\/zotonic.com\/id\/1"},"modified":"2026-09-29T14:40:14Z","title_slug":"controller_websub"},"uri":"https:\/\/zotonic.com\/id\/2705","uri_template":"https:\/\/zotonic.com\/id\/:id","websub":{"hub":"https:\/\/zotonic.com\/.zotonic\/websub","topic":"https:\/\/zotonic.com\/.zotonic\/websub\/topic\/2705"}},"status":"ok"}