docs: add example how to configure custom webhook timeout

content/docs/standalone/latest/documentation/llm/prompt-guards/webhooks.md

@@ -46,6 +46,47 @@ EOF
 
 By default, agentgateway calls `POST /request` and `POST /response` on the webhook target.
 
+## Configure a webhook timeout
+
+Webhook calls use a 10-second timeout by default. The webhook target does not accept inline policies, so to change the timeout, define a named backend that sets `requestTimeout`, then reference that backend from the request and response guards.
+
+```yaml
+cat <<EOF > config.yaml
+# yaml-language-server: $schema=https://agentgateway.dev/schema/config
+backends:
+- name: content-safety-webhook
+  host: content-safety-webhook.example.com:8000
+  policies:
+    http:
+      requestTimeout: "35s"
+llm:
+  models:
+  - name: "*"
+    provider: openAI
+    params:
+      model: gpt-3.5-turbo
+      apiKey: "$OPENAI_API_KEY"
+    guardrails:
+      request:
+      - webhook:
+          target:
+            backend: /content-safety-webhook
+          failureMode: failClosed
+      response:
+      - webhook:
+          target:
+            backend: /content-safety-webhook
+          failureMode: failClosed
+EOF
+```
+
+Backends are referenced as `<namespace>/<name>`. Backends defined in local configuration have no namespace, so the reference starts with `/`.
+
+The timeout applies separately to each webhook call, so request and response guards each receive their own timeout. A timeout is treated as a webhook failure. By default, `failureMode` is `failClosed`, which rejects the request, even when `action: audit` is set. Change `failureMode` to `failOpen` to allow the request when the webhook times out or otherwise fails.
+
+> [!NOTE]
+> The backend host must include a port, and it must be an address that agentgateway can reach, such as `localhost:8000` for a webhook running alongside the proxy.
+
 ## DeepKeep example
 
 You can use [DeepKeep](https://www.deepkeep.ai/) as an external guardrail provider by running the [DeepKeep agentgateway webhook adapter](https://github.com/Deepkeepai/agentgateway-deepkeep-webhook). The adapter exposes the default Guardrail Webhook API paths that agentgateway calls and forwards checks to DeepKeep's pre-model and post-model moderation endpoints.

content/docs/standalone/main/documentation/llm/prompt-guards/webhooks.md

@@ -46,6 +46,47 @@ EOF
 
 By default, agentgateway calls `POST /request` and `POST /response` on the webhook target.
 
+## Configure a webhook timeout
+
+Webhook calls use a 10-second timeout by default. The webhook target does not accept inline policies, so to change the timeout, define a named backend that sets `requestTimeout`, then reference that backend from the request and response guards.
+
+```yaml
+cat <<EOF > config.yaml
+# yaml-language-server: $schema=https://agentgateway.dev/schema/config
+backends:
+- name: content-safety-webhook
+  host: content-safety-webhook.example.com:8000
+  policies:
+    http:
+      requestTimeout: "35s"
+llm:
+  models:
+  - name: "*"
+    provider: openAI
+    params:
+      model: gpt-3.5-turbo
+      apiKey: "$OPENAI_API_KEY"
+    guardrails:
+      request:
+      - webhook:
+          target:
+            backend: /content-safety-webhook
+          failureMode: failClosed
+      response:
+      - webhook:
+          target:
+            backend: /content-safety-webhook
+          failureMode: failClosed
+EOF
+```
+
+Backends are referenced as `<namespace>/<name>`. Backends defined in local configuration have no namespace, so the reference starts with `/`.
+
+The timeout applies separately to each webhook call, so request and response guards each receive their own timeout. A timeout is treated as a webhook failure. By default, `failureMode` is `failClosed`, which rejects the request, even when `action: audit` is set. Change `failureMode` to `failOpen` to allow the request when the webhook times out or otherwise fails.
+
+> [!NOTE]
+> The backend host must include a port, and it must be an address that agentgateway can reach, such as `localhost:8000` for a webhook running alongside the proxy.
+
 ## DeepKeep example
 
 You can use [DeepKeep](https://www.deepkeep.ai/) as an external guardrail provider by running the [DeepKeep agentgateway webhook adapter](https://github.com/Deepkeepai/agentgateway-deepkeep-webhook). The adapter exposes the default Guardrail Webhook API paths that agentgateway calls and forwards checks to DeepKeep's pre-model and post-model moderation endpoints.