A few things that come up often when setting up webhooks:

Every delivery is signed — you'll get an X-StaqOn-Signature header containing an HMAC-SHA256 of the payload, signed with the secret you were shown once at creation time. Verify it server-side before trusting the payload.

If your endpoint returns anything other than a 2xx response 10 times in a row, the webhook auto-disables. If deliveries seem to have silently stopped, that's the first thing to check.

Each delivery also carries an X-StaqOn-Event header telling you which event it is, so one endpoint can handle multiple subscribed events cleanly.