Inbound vs outbound

Inbound (POS → ROS)

X9 POST /v1/integrations/:id/events/… and /webhooks. Signed with the connection API secret. Unchanged by X11.

Outbound (ROS → partner)

X11 developer-platform delivery on the local outbox. Signed with the application webhook secret using the same timestamp + "." + rawBody construction. 4xx is not retried. 5xx/timeout retries up to 3 times. Not Kafka. Not an X9 POS adapter command.