Documentation menu
LiveHow do we receive verdicts asynchronously?

Webhooks

Signed delivery for every decision, including shadow-mode results.

Check the signature

webhook.ts

import { createHmac, timingSafeEqual } from "node:crypto"; const expected = createHmac("sha256", secret).update(rawBody).digest();const received = Buffer.from(signature, "hex"); if (!timingSafeEqual(expected, received)) {  return new Response("invalid signature", { status: 401 });} const event = JSON.parse(rawBody.toString());

Event envelope

decision.sealed.json

{  "type": "decision.sealed",  "dossier_id": "dos_01J...",  "policy_verdict": "ESCALATE",  "effective_verdict": "ALLOW",  "enforcement_mode": "SHADOW"}

Verify before parsing

  1. 01

    Verify the HMAC against the exact request bytes before parsing JSON. A webhook configured without a secret fails closed.

  2. 02

    Every decision is emitted regardless of rollout stage and retried through the durable outbox.

Verify the implementation

Current limits

  • SIEM events are OCSF-shaped; they are not certified OCSF-conformant.

One next step

Continue with the executable path.

Review the API contract