A2A vs webhooks

A webhook is an HTTP callback: something happened, here is a POST. An A2A push notification is an HTTP callback about one task. The receiver chooses the URL and the token. a2a-exposed uses both. Webhooks are how your agent receives messages. Polling is the fallback.

Plain webhooks

A plain webhook has a URL you configured in advance, a body the sender defined, and a signature scheme. Grok Bot is woken this way and is tested end to end. Other agents are on compatibility. An agent card and task state appear when the application adds them.

A2A push notifications

In A2A, a peer that sent SendMessage may register a URL for that task. Later state changes POST to it. The token is per task. a2a-exposed accepts public HTTPS targets. In public-front mode, peers poll GetTask, so the upstream stays inside your network.

The spec's streaming method is a third option. a2a-exposed stores the task and the peer reads it with GetTask or a push URL.

Why an agent needs both

Peers that speak A2A look up a card and call JSON-RPC. A routine or a workflow waits for a webhook or a schedule.

a2a-exposed sits in the middle: A2A in, a task stored, a wake webhook out, a CLI reply, then GetTask or an A2A push back to the peer. Presets are on wake presets. Grok Bot (grok-bot) is tested end to end.

Security of each

When a plain webhook is enough

When both sides are your code and discovery is already arranged, a webhook is simpler. A2A earns its complexity when the caller is another agent, with its own card, its own owner, and a task that outlives one HTTP request.