The Hookdeck alternative that acts on the event, not just delivers it.

Hookdeck is excellent at one job: taking webhooks in and getting them to an endpoint reliably — retries, queues, replay, a great local-dev CLI. ingestlayer ingests too, but the payload isn't where it stops. Between arrival and delivery it enriches, classifies, and redacts the event, then routes it to the apps your team actually works in — Slack, Postgres, Notion, a desktop ping. Hookdeck moves the event. ingestlayer decides what it means and sends it somewhere useful.

Hookdeck is built around reliability: receive a webhook from one of 120+ sources, verify the signature, queue it, retry it with backoff, and deliver it to a URL — with logs, traces, and replay so nothing silently drops. That part is genuinely good, and at billions of events it's a thing you do not want to build yourself.

What it doesn't do is act on the payload. Hookdeck has a transformation step, but it runs in a sandboxed isolate with no network access, no await, and a one-second budget. That's a deliberate, sensible constraint for safe reshaping — and it also means the transform cannot resolve the company behind an email, ask a model whether a subscription is a churn risk, or strip a phone number before it reaches a shared channel. The event arrives, gets reshaped, and is delivered with its meaning untouched. Anything past that goes back to your code on the receiving end.

Its destinations follow from the same shape. The Event Gateway delivers to an HTTP endpoint, the CLI, or a mock; the outbound product adds queues like SQS, Kafka, and Pub/Sub. Those are places you operate — not Slack, not a Postgres table, not Notion, not a notification on your desk. To land an event in a tool a human looks at, you still write the consumer.

Here's a Stripe subscription in both tools. In Hookdeck, you reshape the payload and hand it to your endpoint:

// hookdeck transformation — reshape the payload, and stop there.
// it runs in a sandbox: no network, no fetch, no await, 1s budget.
addHandler("transform", (request) => {
  const e = request.body;
  return {
    ...request,
    body: {
      email: e.data.object.customer_email,
      plan:  e.data.object.items[0].price.nickname,

      // you CANNOT do any of this here — there is no network:
      //   const person = await enrich(e.customer_email)
      //   const tier   = await classify(e)
      //   const masked = await redact(e)
    },
  };
});
// then Hookdeck delivers it — same meaning, reshaped — to your URL.

Reliable, and exactly as far as the sandbox lets it go. ingestlayer starts from the same webhook and keeps going — the event gets enriched, read by a model, redacted, and fanned out three ways, each shaped for whoever's on the other end:

# pipelines/subscriptions.yaml — the event, understood and routed
pipeline: subscriptions

source:
  type: webhook.stripe
  match: customer.subscription.created

steps:
  - enrich.person: $event.customer_email   # email → a real name + company

  - classify:                              # let a model read it before you do
      input: $event + $person
      labels:
        tier: [enterprise, smb, churn_risk]

  - redact:                                # mask PII before it reaches chat
      fields: [$event.customer_email]
      for: [slack]

destinations:
  - valve:                                 # native desktop ping, nothing to build
      when: $classify.tier == "enterprise"
      title: "{{ $person.company }} just upgraded"

  - slack:                                 # the channel hears the ones that matter
      channel: "#revenue"
      when: $classify.tier != "churn_risk"
      template: |
        {{ $person.name }} · {{ $person.company }} · {{ $classify.tier }}

  - warehouse.pg:
      table: events.subscriptions          # everything lands here, enriched

Same trigger. One tool guarantees it arrives; the other decides what it means and sends it where it needs to go — an enterprise upgrade buzzes your desk, the revenue channel hears the signal without the PII, and Postgres keeps every enriched record. From one file you can diff in a pull request.

Hookdeck wins the rows it's built to win — we've marked them honestly. On EU residency: Hookdeck's managed Event Gateway runs on US-based subprocessors under a Canadian-incorporated company, with EU residency a contractual / enterprise matter; only its separate open-source Outpost product lists EU regions. Confirm against your own requirements before relying on it either way.

A transform layer with a network. Between arrival and delivery, ingestlayer runs typed actions that can reach the outside world — enrich.person turns an email into a name and a company, classify hands the event to a model and returns a typed label you can route on, summarize shrinks a wall of text to two lines. This is the step Hookdeck's sandbox is specifically designed not to allow — and it's where a decision actually gets made, mid-pipe, before anyone gets pinged.

Destinations that are apps, not endpoints. Slack, Telegram, Discord, Notion, Postgres, Email, and an HTTP webhook are first-class destinations you route to directly, each with its own shape and its own condition — not a single URL you then have to write a consumer for. The routing lives in one place instead of in the service on the other end of Hookdeck's delivery.

A notification on your desk, not just an ops alert. Hookdeck can alert you when a delivery fails — Slack, PagerDuty, email for the plumbing. It can't ping you because an event was interesting. valve, our desktop app, is just another destination: add one line and an event worth seeing fires a native notification — the enterprise upgrade, the high-value signup — with nothing to build.

PII redaction, and EU hosting as standard. A subscription or signup carries an email, a name, sometimes a phone. ingestlayer applies a per-destination redaction matrix at fan-out, so Slack sees a masked address while the warehouse keeps the real one — and the whole thing runs in the EU without a sales call. Two properties Hookdeck's managed gateway, US-hosted and redaction-free, doesn't hand you out of the box.

Hookdeck and ingestlayer aren't strictly either/or. If you're already running Hookdeck for hardened, high-volume ingestion, point one of its HTTP destinations at an ingestlayer pipeline and let it handle the part Hookdeck can't — the enrichment, the classification, the redaction, the fan-out to real apps. Most teams find ingestlayer's own ingestion is enough on its own and drop the extra hop. Either way, the intelligence lives in one place.

If the job is purely to receive webhooks at serious scale and deliver them, untouched, to endpoints and queues you run — billions of events into your own SQS, Kafka, or backend — Hookdeck is purpose-built for exactly that, and it's very good at it. Its local-dev CLI is a genuine ngrok replacement that ingestlayer doesn't try to match, and its observability and replay around raw delivery are mature. If you need none of the payload understood and everything kept inside infrastructure you operate, that one's Hookdeck's.

Switch when the event needs to do something on the way out: get enriched into a customer you recognize, get read by a model and routed by meaning, land in Slack and Postgres and a desktop notification at once, or get its PII stripped before it reaches a shared channel. And switch if EU data residency is a requirement rather than a line in an enterprise contract. Those are the jobs the gateway model wasn't built for, and they're the whole reason ingestlayer exists.

The providers already sending you webhooks — Stripe, GitHub, Shopify — don't care what's on the receiving end. Point them at an ingestlayer ingress instead of, or alongside, Hookdeck: the HTTP ingress and SDK take the payload they already send, signatures and all. Start with one pipeline — the noisy Stripe stream is a common first win — add the steps it needs, and route it where it belongs. Nothing has to move at once.