Webhooks
Subscribe to run-state changes and finding events. Webhooks are signed with HMAC-SHA256; verify the signature before trusting the payload.
01
Events
- `run.completed` — fires when a run reaches a terminal state.
- `finding.created` — fires for every new finding.
- `evidence_pack.ready` — fires when the signed evidence pack is downloadable.
02
Setup
- Register the endpoint in Settings → Webhooks.
- Store the signing secret in your secrets manager.
- Verify `X-DiD-Signature` against the raw body.