A working glossary of the terms that appear in every composable RFP, brief, and architecture conversation.
API-first is a design approach where the API contract is defined before any backend or frontend code is written, treating the API itself as the primary product. It produces consistent endpoints, predictable versioning, and platforms that integrate cleanly with whatever channel comes next, whether that is a website, an iOS app, or an AI agent. The discipline matters most in composable stacks because the API is the connective tissue between every best-of-breed service.
An asset is binary content stored in a CMS or DAM, including images, videos, PDFs, audio files, and brand-related files like fonts and logos. A DAM platform like Bynder is the system of record for assets at enterprise scale, while a CMS like Contentful often holds a working subset for the channels it serves. Asset workflows usually cover ingestion, metadata tagging, rights management, derivative generation (thumbnails, formats), and the delivery URL that downstream services consume.
AEO (Answer Engine Optimization) is the discipline of structuring content so that AI answer engines like Perplexity, ChatGPT Search, and Google AI Overviews can quote or cite it directly. Core techniques include question-shaped headings, answer-first paragraphs, liftable lists, FAQ sections with FAQPage schema, and strong citation hygiene (bylines, dates, primary sources). AEO is a superset of classical SEO that assumes the reader is often an LLM composing an answer, which changes the writing patterns that win.
Accessibility (often abbreviated a11y) is the design and engineering discipline of building digital experiences that people with disabilities can use, including visual, auditory, motor, and cognitive disabilities. Accessibility covers keyboard navigation, screen reader support, color contrast, focus management, captioning, semantic HTML, and ARIA attributes for custom widgets. For enterprise brands, accessibility is also a legal obligation in many jurisdictions (ADA in the US, EAA in the EU) and a clear factor in brand trust.
ARIA (Accessible Rich Internet Applications) is a W3C specification that provides extra semantics for custom UI widgets like menus, tabs, and dialogs, so assistive technologies can interpret them correctly. ARIA defines roles (what an element is), states (what it is currently doing), and properties (its capabilities), which assistive tech like screen readers and switch devices uses to describe the page to users. The first rule of ARIA is to avoid using ARIA when possible: native HTML elements (button, dialog, details) come with the correct semantics built in, and ARIA is the fallback for custom widgets HTML does not provide.
Bot detection is the discipline of distinguishing human users and form submitters from automated scripts and crawlers, without forcing the human user to solve a CAPTCHA. Modern bot detection tools (Vercel BotID, Cloudflare Turnstile, Google reCAPTCHA v3, hCaptcha) score each request based on browser fingerprint, behavioral signals, and network reputation. Bot detection runs invisibly for genuine users, only challenging the requests the system flags as suspicious, which keeps form completion rates high while blocking the majority of automated submissions.
Composable architecture is a software pattern that assembles a business platform from independent, API-first services instead of from one monolithic vendor stack. Teams pick a best-of-breed product for each capability (CMS, DAM, search, delivery, messaging) and connect them through documented APIs and a shared content model. The trade-off is more integration work up front, in exchange for the ability to swap any single service later without rebuilding the whole platform.
Cloud-native is an application design pattern where software is built specifically for managed cloud services like containers, serverless functions, and edge runtimes, rather than retrofitted to them. It assumes elastic scaling, ephemeral compute, and managed infrastructure as defaults, which removes most of the capacity planning that legacy on-premise platforms required. Most modern composable platforms (Vercel, Netlify, AWS Lambda, Cloudflare Workers) are cloud-native by design.
A content model is the schema and relationships that define every type of content an editorial team can publish, the fields each type has, and how different types reference each other. In a headless CMS like Contentful or Sanity, the content model is the foundation on which the platform is built, because it determines what editors can create, what the API returns, and what the frontend can render. Most modernization failures trace back to a content model that was lifted from the old platform without rethinking it for headless delivery and multi-channel reuse.
A content type is a single reusable schema inside a CMS that defines the fields and relationships of one kind of content, such as event, article, speaker, or product. Each content type becomes an API endpoint and a content-creation template for editors, which is how the same platform can deliver press releases, product pages, and event landing pages from one codebase. Well-scoped content types are typically short, with five to twelve fields, and they reference each other instead of duplicating data.
A CDN (Content Delivery Network) is a distributed network of servers that caches static content at points-of-presence around the world, so users connect to a nearby server instead of a far-away origin. CDNs reduce page load latency, absorb traffic spikes, terminate TLS efficiently, and add a layer of DDoS protection at the network edge. For composable platforms, the CDN typically hosts the prerendered frontend output from Vercel, Cloudflare, or Akamai, with the headless CMS and other services sitting behind the cache as origins.
A CMS (Content Management System) is the software platform where editorial teams author, organize, and publish content, and where the underlying data model lives. Traditional CMS platforms like AEM and Sitecore couple authoring with rendering in one stack, while headless CMS platforms like Contentful and Sanity expose content as an API and leave rendering to a separate frontend. For enterprise teams moving toward composable architecture, the CMS is usually the first platform to replace, because it owns the content model that every downstream channel reads from.
Cache Components is a Next.js 16 primitive that caches the output of a Server Component with explicit cache tags and lifetimes, replacing the implicit fetch-based caching of earlier versions. Developers declare what data a component depends on, what tags identify that data, and how long the rendered output stays valid, which gives the framework the information it needs to invalidate precisely on content updates. The shift makes cache behavior explicit instead of inferred, which solves the most common Next.js performance bug: cache poisoning from accidentally-dynamic Server Components.
Core Web Vitals are Google's standardized user-experience health metrics, currently Largest Contentful Paint (LCP), Interaction to Next Paint (INP), and Cumulative Layout Shift (CLS). Each metric has a "good" threshold (LCP under 2.5 seconds, INP under 200 milliseconds, CLS under 0.1) that pages must hit on 75 percent of real-user sessions for Google to count them as passing. Core Web Vitals are a confirmed search-ranking signal and a strong proxy for perceived quality, which is why they appear in nearly every modernization brief.
CLS (Cumulative Layout Shift) is the Core Web Vitals metric that measures unexpected layout shifts in a page during its lifetime, summed across all shifts as a unitless score. Google considers a CLS under 0.1 as good, 0.1 to 0.25 as needs improvement, and over 0.25 as poor. Most CLS problems come from images without explicit dimensions, late-loading ads or embeds, and web fonts that swap once they download, all of which have well-known fixes.
A cache hit is a request that finds an existing fresh entry in the cache and is served from the cache directly, without contacting the origin server. Cache hits are essentially free in compute terms, often under 30 milliseconds end-to-end, which is why high cache hit rates are a core optimization target for any composable frontend. Most teams aim for a cache hit ratio above 90 percent on a content-heavy marketing site, with the misses dominated by editorial updates and stale-while-revalidate backfills.
A cache miss is a request that finds no fresh cache entry and is forwarded to the origin server, which builds and returns a response that the CDN then caches for future requests. Cache misses are slower than hits (the round-trip to origin plus compute time) and more expensive to serve, which is why every misconfigured cache surfaces first as a latency or cost problem. Most enterprise composable architectures use stale-while-revalidate to keep cache misses out of the critical path, serving stale content fast while the cache refreshes in the background.
CSRF (Cross-Site Request Forgery) is a vulnerability where a malicious site tricks a logged-in user's browser into submitting a request to a different site (the user's bank, for example) on the user's behalf. The standard defense is a CSRF token: a unique value the server issues for each session that the client must include with any state-changing request, which a third-party site cannot read or forge. In Next.js, CSRF protection is built into Server Actions, but custom API routes and traditional form posts need explicit token issuance and verification.
CSP (Content Security Policy) is an HTTP response header that tells the browser which sources of scripts, styles, images, fonts, and other resources are allowed to load on a page. A well-configured CSP blocks the most common XSS attacks, prevents data exfiltration through inline scripts, and limits what compromised third-party libraries can do. CSPs are notoriously hard to roll out without breaking analytics, ad pixels, and third-party widgets, which is why teams typically deploy them in report-only mode first to catch violations before enforcing.
A DAM (Digital Asset Management) platform is the system of record for an organization's images, videos, brand files, and rights metadata. Bynder, Cloudinary, and Aprimo are common enterprise DAM choices, with workflows for ingestion, tagging, approval, derivative generation, and delivery to downstream CMS, ecommerce, and marketing platforms. A DAM is where the AI-ready metadata gets created, because the content model decides what downstream tools can actually do with each asset.
An entry is a single instance of a content type in a headless CMS, like one specific event, one article, or one speaker profile. Editors create, edit, and publish entries through the CMS authoring interface, and each entry is exposed through the platform's content delivery API for the frontend to render. In Contentful, an entry has a stable ID that the frontend uses to fetch it, and a version history that the platform keeps for rollback and audit.
An edge function is server-side code that runs inside a CDN point-of-presence physically close to the user, rather than in a single central data center region. Vercel Edge Functions, Cloudflare Workers, and Netlify Edge Functions all run a lightweight V8 isolate that boots in under a millisecond and handles requests with sub-50ms cold starts. Edge functions are the right place for authentication checks, personalization rules, A/B test branching, and request rewriting, but not for heavy compute or long database queries.
An experimentation platform is the infrastructure for running A/B tests, multivariate tests, and feature experiments on a live audience, including traffic allocation, variant assignment, and statistical significance calculation. Optimizely, Statsig, LaunchDarkly, and Vercel Edge Config support experimentation alongside feature flags, with results piped back into the team's analytics for decision-making. The platform is the easy part; most experimentation programs fail at hypothesis quality and the discipline to stop tests that are not moving the needle.
Edge computing is the pattern of running server-side code in points-of-presence close to the user, typically inside a CDN's global network, instead of in a single central data center. Vercel Edge Functions, Cloudflare Workers, and Fastly Compute@Edge are the most common edge runtimes, each running a lightweight V8 isolate with sub-millisecond cold starts. Edge computing is the right place for low-latency request handling like authentication checks, personalization decisions, A/B test assignment, and request rewriting, but not for heavy compute or stateful operations.
Eventual consistency is a data-distribution property where a write propagates to all replicas eventually, but reads in the interval between the write and full propagation may return stale values. CDNs, replicated databases, and DNS all behave eventually consistently, with propagation windows ranging from milliseconds to minutes depending on the system. Eventual consistency is the right trade-off for content-heavy systems because it scales cheaper than strong consistency, as long as the application surfaces the staleness appropriately through last-updated timestamps or optimistic UI.
A feature flag is a runtime switch in code that turns a particular code path on or off without redeploying the application, controlled through a configuration service. Flags are used to gate access to new features (rolling them out to a percentage of users), to kill-switch broken code in production, and to coordinate releases between marketing and engineering. LaunchDarkly, Statsig, and Vercel Edge Config are common flag platforms, all of which evaluate the flag at request time so changes take effect without a code deploy.
GEO (Generative Engine Optimization) is Answer Engine Optimization applied specifically to generative AI engines, including ChatGPT, Claude, Perplexity, Google AI Overviews, and Microsoft Copilot. The patterns are the same as AEO (answer-first paragraphs, structured data, citation hygiene) but with extra emphasis on chunkable content, named-entity density, and primary-source trust signals. For B2B brands, GEO determines whether your platform shows up as a cited source when buyers ask an AI about your category, which is increasingly where decision research starts.
A headless CMS is a content management system that exposes its content as JSON or GraphQL and leaves rendering to a separate frontend. The presentation layer is decoupled from storage and the editorial workflow, so the same content can power web, mobile, kiosk, voice, and AI surfaces from one source. Contentful, Sanity, and Storyblok are common headless choices for enterprise teams moving off legacy platforms like AEM or Sitecore.
HMAC (Hash-based Message Authentication Code) is a cryptographic algorithm that combines a hash function (typically SHA-256) with a shared secret to produce a fixed-length signature for a piece of data. The signature proves two things: the data was not modified in transit, and the sender knew the shared secret, which together provide integrity and authentication. HMAC is the algorithm behind nearly every webhook signature scheme (Stripe, Contentful, GitHub, Slack), behind JWT HS256 signing, and behind many internal service-to-service authentication patterns.
A honeypot is a hidden form field that is invisible to human users (positioned off-screen with CSS or hidden via tabindex) but visible to automated form-fillers in the HTML. When a submission arrives with the honeypot field filled in, the server rejects it without explanation, on the basis that no human could have typed into the field. Honeypots are the cheapest, most accessible spam defense for low-risk forms, often catching 80 to 95 percent of automated submissions on their own.
ISR (Incremental Static Regeneration) is a Next.js rendering pattern where a page is built once as static HTML, served from a CDN, and rebuilt in the background when its underlying data changes. A revalidation interval or an on-demand revalidate call, typically fired from a CMS webhook, triggers the rebuild, and the next request sees the fresh page. ISR is the default rendering choice for content-heavy marketing sites because it pairs static-CDN speed with editorial freshness, without the cost of server-rendering every request.
Image optimization is the practice of automatically resizing source images, converting them to modern formats like AVIF and WebP, and serving the smallest viable variant to each device. Next.js Image, Cloudinary, imgix, and Vercel's image pipeline all perform on-the-fly optimization with caching, so editors upload one source image and the platform handles the per-device variants. For composable platforms, image optimization is the single largest LCP improvement available, often cutting the largest contentful paint by 30 to 60 percent on image-heavy pages.
INP (Interaction to Next Paint) is the Core Web Vitals metric that measures how quickly a page responds to user interactions like clicks, taps, and key presses, sampling the worst (or near-worst) interaction across the visit. Google considers an INP under 200 milliseconds as good, 200 to 500 milliseconds as needs improvement, and over 500 milliseconds as poor. INP replaced First Input Delay (FID) as a Core Web Vital in March 2024, because INP captures sustained responsiveness rather than just the initial reaction.
Idempotency is the property of an operation that produces the same end-state regardless of how many times it is invoked with the same inputs. GET, PUT, and DELETE are idempotent by HTTP convention, while POST is not, and idempotency keys are used to make POST operations safe to retry on network failures. Idempotency matters most at the integration layer of composable platforms, where webhook retries and event reprocessing are common and an operation must be safe to run twice without doubling its effect.
JAMstack is an architectural pattern from 2015 that combined JavaScript on the frontend, APIs for dynamic data, and static markup pre-rendered at build time, served from a CDN. The acronym (JavaScript, APIs, Markup), coined by Netlify, framed a generation of static-site generators like Gatsby, Hugo, and early Next.js, before serverless and edge runtimes made the architecture more dynamic. Most teams now use the word "composable" instead, because the underlying assumptions about static prerendering no longer fully describe how modern frontends work.
JSON-LD (JavaScript Object Notation for Linked Data) is a JSON syntax for embedding Schema.org structured data inside a web page, typically as a script tag in the head. It is the recommended format by Google and most AI engines because it sits next to the HTML without affecting the visible layout, and it cleanly nests entity references and properties. In Next.js, JSON-LD is typically rendered as a script tag in the page layout, with the structured data composed from the same content fields the page itself uses.
A JWT (JSON Web Token) is a signed JSON object that carries claims about a subject (typically a user) and can be passed between services to authorize requests. A JWT has three parts (header, payload, signature) joined by dots, with the signature cryptographically validating that the payload has not been altered since the token was issued. JWTs are common for stateless authentication in microservices and SPAs, though their expiration handling, revocation, and storage in the browser all have well-known pitfalls.
A locale is a language and region pair, written in BCP 47 format such as en-US or es-ES, that identifies which audience a piece of content is for. A headless CMS uses locales to manage parallel translations of the same entry, so editors can publish a single content piece across multiple regional sites with localized text and formatting. Locale strategy decides which markets a platform serves at launch, how fallback languages work when a translation is missing, and whether the URL structure varies by region.
LCP (Largest Contentful Paint) is the Core Web Vitals metric that measures when the largest visible element on a page (usually the hero image or main headline) finishes rendering. Google considers an LCP of 2.5 seconds or less as good, between 2.5 and 4 seconds as needs improvement, and over 4 seconds as poor. Image optimization, server-side rendering or static generation, and removing render-blocking JavaScript are the three highest-leverage LCP fixes in most modernizations.
MACH is an acronym for Microservices, API-first, Cloud-native, and Headless, four design principles that together describe what most people now call composable architecture. The MACH Alliance, founded in 2020, promotes the acronym as a vendor-certification standard for platforms that meet all four criteria. In practice the terms MACH and composable are used interchangeably, with composable being the broader business term and MACH the technical label.
Microservices are an architectural pattern where a business platform is split into small, independent services that each own their data and communicate over the network through APIs. Each service can be deployed, scaled, and updated without coordinating with the others, which makes the teams that own them faster but raises the bar for observability and contract management. A composable martech stack is effectively a microservices architecture at the platform layer, with Contentful, Algolia, Bynder, and Vercel each running as an independent service.
An MPA (Multi-Page Application) is a web architecture where each navigation triggers a real HTTP request and a fresh server-rendered page, the default approach for marketing sites and most CMS-driven content. MPAs win on initial load performance, SEO, accessibility defaults, and browser-native back-button behavior, at the cost of slightly less app-like feel on internal navigation. Most enterprise composable sites use an MPA-style architecture with view transitions, so each page is fast and indexable while navigation still feels fluid.
Open Graph is a metadata standard, introduced by Facebook in 2010, that publishers add to a page's head to control how the page appears when shared on social platforms. The og:title, og:description, and og:image tags determine the title, blurb, and preview image that surface in Facebook, LinkedIn, Slack, iMessage, and most messaging apps. Open Graph is one of the highest-leverage 30-minute tasks in a publishing workflow, because most click-throughs from social and chat depend entirely on which preview the platform composes.
An origin is the canonical server behind a CDN, the place a CDN edge fetches content from when it has a cache miss. An origin can be a single application server, a load-balanced cluster, an object store like S3 or R2, or a managed application platform like Vercel. Origin protection is a security concern because exposing the origin URL bypasses the CDN's caching and DDoS protection, which is why most modern CDNs offer origin shields and IP allowlists.
OAuth is an authorization protocol that lets a user grant a third-party application limited access to their resources on another service, without sharing their password. OAuth 2.0 is the current widely-used version, with flows for browser apps, server apps, native mobile, single-page apps, and machine-to-machine tokens. OAuth is what powers "Sign in with Google" and "Connect to LinkedIn" buttons, and it underpins how composable platforms talk to each other on a user's behalf.
A PIM (Product Information Management) platform is the system of record for product attributes, taxonomies, and SKU-level data that downstream commerce and marketing tools consume. Akeneo, inriver, and Salsify centralize SKU descriptions, specifications, images, and channel-specific overrides, so the same product reads consistently across ecommerce, marketplaces, and print catalogs. A PIM becomes essential the moment a brand sells more than a few hundred SKUs through more than one channel, because product data drifts across systems otherwise.
A personalization engine is a service that decides which variant of content, layout, or offer a specific visitor should see based on their attributes, behavior, or membership in an audience segment. Optimizely and Dynamic Yield are common personalization engines in enterprise stacks, often paired with a CMS that holds the variant content and a CDP that supplies the audience signals. A personalization engine is only as good as the audiences feeding it and the experiment discipline behind it, which is why most personalization programs stall on data quality rather than platform features.
Rich text is a structured-document content field in a CMS that supports headings, lists, paragraphs, links, embeds, and code blocks, exposed as a parseable tree rather than raw HTML. Contentful's Rich Text format is a JSON tree that the frontend renders through a known set of node types, which gives editors WYSIWYG authoring without locking the output to one design system. Rich text is the right choice for long-form editorial content, while structured fields (Symbol, Number, Reference) handle metadata, taxonomies, and links.
RSC (React Server Components) are components in React 19 and later that render exclusively on the server, with their output streamed to the client as serialized React rather than HTML. Server Components can access databases, file systems, and private APIs directly, while Client Components handle the browser-side interactivity, and Next.js App Router orchestrates the mix. The pattern reduces JavaScript bundle size because non-interactive components never ship to the browser, which is the largest single contributor to Core Web Vitals improvements on modern apps.
Revalidation is the process of asking the origin whether cached content is still fresh, and either rebuilding the cache entry or serving the existing one if it is. Revalidation can be time-based (the cache entry expires after N seconds), tag-based (the cache invalidates when a related event fires), or on-demand (an API call forces a rebuild). In Next.js, the revalidateTag and revalidatePath functions are typically called from a Contentful webhook handler when content publishes, so editorial updates ship within seconds.
A rate limit is a ceiling on how many requests a single client (identified by IP, API key, or user ID) can make to a service in a given time window. Common patterns include fixed-window counters, sliding windows, token buckets, and leaky buckets, each with different trade-offs for burst tolerance and implementation complexity. Rate limits protect services from abuse, accidental loops in client code, and cost overruns from expensive operations, and they are typically applied at the CDN, API gateway, or application layer.
SSR (Server-Side Rendering) is a rendering strategy where a page's HTML is generated on demand on the server for each incoming request, then sent to the browser. It produces fresh-per-request HTML that personalization, authentication, and live data work cleanly with, at the cost of higher origin compute compared to static rendering. Next.js, Remix, and Astro all support SSR through their server runtimes, and most composable architectures use SSR for authenticated pages and ISR for everything else.
SSG (Static Site Generation) is a rendering strategy where every page is built into static HTML at deploy time, uploaded to a CDN, and served identically to every visitor. It is the fastest and cheapest way to serve content, with zero per-request compute and CDN-only delivery, but every content update requires a full rebuild and redeploy. SSG works well for marketing sites, documentation, and blogs with low update frequency, while ISR adds incremental rebuilds for sites where editorial updates need to ship within minutes.
A Server Action is a Next.js mechanism for calling server-side code directly from a client-side form submit or event handler, without writing a separate API route. The function is marked with a "use server" directive, can access databases and private services, and ships its invocation as an RPC under the hood from the React framework. Server Actions are how forms, mutations, and content writes work in modern Next.js apps, replacing the older pattern of POSTing to a hand-authored API route.
Suspense is a React primitive that lets a component show fallback UI (like a skeleton or spinner) while its children are waiting for data or code to load. It works with both code-splitting (lazy-loaded components) and data fetching (Server Components, the use hook, third-party libraries), and it composes through nested Suspense boundaries to control granularity. In Next.js App Router, Suspense is the mechanism that powers streaming server rendering, sending fast initial HTML to the browser while slower data resolves in the background.
Streaming is a rendering pattern where the server sends HTML to the browser in chunks as each piece becomes ready, instead of waiting for the entire page to finish rendering. The browser starts painting the page from the first chunk, so users see the header, hero, and primary content while slower parts (like personalized recommendations) finish in the background. Streaming server rendering is one of the largest LCP and TTFB improvements available on modern frontends, and it is enabled by default in Next.js App Router via Suspense boundaries.
Schema.org is a shared vocabulary of types and properties (like Article, Event, Product, Person) that publishers use to mark up the structured data inside a web page. Search engines (Google, Bing) and AI answer engines (ChatGPT, Perplexity, Google AI Overviews) read Schema.org markup to understand a page's content beyond the visible text. Schema.org is the single most-cited input to AI Overview and Featured Snippet selection, which is why GEO and AEO programs treat it as a launch-day requirement.
SEO (Search Engine Optimization) is the discipline of making web pages findable, rankable, and clickable in search engines, primarily Google and Bing. It covers technical SEO (crawlability, performance, structured data), on-page SEO (content quality, keyword targeting, internal linking), and off-page SEO (backlinks, brand mentions, citations). Classical SEO still drives most organic traffic for B2B brands, but AEO and GEO are now sibling disciplines that share the same content but optimize for different reader types.
An SPA (Single-Page Application) is a web application that loads the shell once and updates the URL and view through client-side JavaScript, without triggering full page reloads on navigation. SPAs feel fluid because navigation is instant after the initial load, but they pay a cost in slower first paint, more complex SEO, and the constant risk of orphan state across views. Most modern Next.js applications are technically hybrid SPA-MPA: the initial render is server-rendered HTML, and subsequent navigations happen client-side with prefetched route data.
Stale-while-revalidate (SWR) is a caching pattern where the cache serves a stale response immediately on a cache miss, while a background revalidate fetches and stores the fresh response for the next request. The pattern is defined in HTTP RFC 5861 and supported by most CDNs (Vercel, Cloudflare, Fastly), and by the SWR React library for client-side data fetching. Stale-while-revalidate gives users instant page loads while still ensuring eventual freshness, which is the right trade-off for almost all marketing and editorial content.
A token is a string that authorizes a specific action or grants access to a specific resource, typically embedded in an HTTP header or URL parameter. Tokens can be opaque (a random ID the server looks up) or signed (a JWT or HMAC the receiver verifies without a database lookup), with different trade-offs for revocation and statelessness. Most modern composable platforms use a combination of session tokens for user authentication, API tokens for service-to-service calls, and signed URL tokens for time-limited access to assets.
A webhook is an HTTP callback that one service fires at another to notify it that an event happened, such as a content publish, an asset upload, or a form submission. Receivers expose a public URL, validate the incoming request through a signature header, and respond with a 200 to confirm receipt before processing the event asynchronously. Composable platforms use webhooks heavily because they let independent services coordinate without polling, like Contentful telling Algolia to reindex when a new article publishes.
WCAG (Web Content Accessibility Guidelines) is the international standard for digital accessibility, published by the W3C and adopted by regulators in the US, EU, UK, Canada, and elsewhere. WCAG 2.2 is the current version, organized into four principles (Perceivable, Operable, Understandable, Robust) and three conformance levels (A, AA, AAA), with AA the typical compliance target. Most enterprise digital programs target WCAG 2.2 AA across the public site, and many require AAA for high-value or high-risk surfaces like ecommerce checkout and account management.
A webhook signature is a cryptographic hash (usually HMAC-SHA256) that the sender computes from the request payload and a shared secret, and includes in an HTTP header so the receiver can verify the payload's authenticity. The receiver computes the same hash on the incoming payload and compares it to the header value, rejecting the request if the hashes do not match in constant time. Every public webhook endpoint must verify signatures, because the endpoint is publicly addressable and an unauthenticated webhook handler is a trivial denial-of-service or data-injection vector.