Skip to main content
WEBHOOK

Authorizations

​
Authorization
string
header
required

An organization API key. Keys carry a role (read_write or read_only) and may be restricted to a namespace prefix such as acme/*, or to one namespace such as acme/prod/tenant_1. A prefix matches on a / boundary: acme/prod/tenant_1* covers acme/prod/tenant_1 and everything under acme/prod/tenant_1/, never acme/prod/tenant_12.

Headers

​
webhook-id
string
required

The event's id. A retry, a redelivery or a replay repeats it, so dedupe on it. Also the webhook-id header.

Pattern: ^evt_[0-9a-z]{26}$
​
webhook-timestamp
integer<int64>
required

When this attempt was sent, in Unix seconds. Reject a request more than 5 minutes off your clock.

​
webhook-signature
string
required

Space-separated signatures, each v1, and the base64 HMAC-SHA256 of {webhook-id}.{webhook-timestamp}.{body}, keyed by the endpoint's secret: the part after whsec_, base64-decoded. While a rotated secret is still valid there is one signature per secret; accept the request if any of them matches.

Body

application/json
​
id
string
required

Also the webhook-id header.

Pattern: ^evt_[0-9a-z]{26}$
​
timestamp
string<date-time>
required

When the event was recorded.

​
type
any
required
​
data
object
required

The quality check of a new epoch did worse than the last check that passed. Sent once per judgment and epoch, to each judgment whose active version uses the engine when the event is sent. Answers are neither blocked nor re-judged, and the engine stays active.

​
test
boolean

True on every event a test send sends, webhook.test or a sample of a named type. Absent otherwise, and never in the feed.

Response

2XX

Received. Anything else, or no answer within 15 seconds, is retried.