Webhooks

Webhooks are included in Premium and Enterprise. They are not in the demo:

webhook and SIEM delivery start once your organization is on a plan.

Webhooks send a signed JSON POST to your endpoint when subscribed events occur (assessment completed, finding status changed, incident created, and more).

AI governance events

• ai_system.proposed: an AI system was proposed, from the page, the API or an AI assistant connection.
• approval.decided: a review of an AI system closed; the payload carries the outcome.
• approval.expiring: an approval reaches its review date within 30 days, when a re-review opens automatically. Sent once per approval.
• metric.threshold_breached: a deployed system's reported metric moved past its breach threshold. Sent once per crossing, not once per point.
• model_version.registered: a new version of a model was recorded.

Verifying deliveries

Every request carries an X-Backsplice-Signature header of the form sha256=<hex> — the HMAC-SHA256 of the raw body using your webhook secret. Recompute it and compare with a constant-time function before trusting the payload.

Rotating the secret

Rotate from Settings → Webhooks. The new secret signs the next delivery; for 24 hours every delivery also carries X-Backsplice-Signature-Previous — the same body signed with the superseded secret. Verify against either header during that window, then switch your receiver to the new secret and stop accepting the previous one. After 24 hours the previous signature is no longer sent.

Reliability

Respond with a 2xx within 5 seconds. A failed delivery is retried automatically with exponential backoff, and you can replay any delivery from the delivery log. A webhook that fails repeatedly is auto-suspended until you re-enable it.