LiveHow do we receive verdicts asynchronously?
Webhooks
Signed delivery for every decision, including shadow-mode results.
Check the signature
webhook.ts
import { createHmac, timingSafeEqual } from "node:crypto"; const expected = createHmac("sha256", secret).update(rawBody).digest();const received = Buffer.from(signature, "hex"); if (!timingSafeEqual(expected, received)) { return new Response("invalid signature", { status: 401 });} const event = JSON.parse(rawBody.toString());Event envelope
decision.sealed.json
{ "type": "decision.sealed", "dossier_id": "dos_01J...", "policy_verdict": "ESCALATE", "effective_verdict": "ALLOW", "enforcement_mode": "SHADOW"}Verify before parsing
- 01
Verify the HMAC against the exact request bytes before parsing JSON. A webhook configured without a secret fails closed.
- 02
Every decision is emitted regardless of rollout stage and retried through the durable outbox.
Verify the implementation
Decision and record shapes.
/developers/api →
Current limits
- SIEM events are OCSF-shaped; they are not certified OCSF-conformant.
One next step
Continue with the executable path.