Webhook events

Every event your endpoint can subscribe to. Backsplice POSTs a signed JSON body ({ event, timestamp, payload }) for each subscribed event; verify the X-Backsplice-Signature header (HMAC-SHA256 of the raw body with your secret). For 24 hours after you rotate a secret, each delivery also carries X-Backsplice-Signature-Previous, the same body signed with the superseded secret — accept either during that window, then drop the old one. Failed deliveries retry with backoff and can be replayed from Settings → Webhooks.

AI governance

Event	Fires when
`ai_system.proposed`	A system was added to the register (it uses AI and starts proposed, or it does not and starts in use), from the page, the API or MCP; the payload carries uses_ai and handles_ephi.
`approval.decided`	A review of an AI system closed with its outcome (approved, approved with conditions, rejected, sent back or withdrawn).
`approval.expiring`	An AI system's approval reaches its review date within 30 days, when a re-review opens (ai-rereview cron; once per approval).
`model_version.registered`	A new version of an AI model was recorded (from the page or the API).
`metric.threshold_breached`	A deployed system's reported metric crossed its action threshold, `breach_threshold` in the API (once per crossing, from POST /api/v1/metrics).

Assessments

Event	Fires when
`assessment.completed`	An assessment was marked complete.
`assessment.archived`	An assessment was archived.

Findings

Event	Fires when
`finding.status_changed`	A finding moved between statuses (open → resolved, etc.).
`finding.risk_changed`	A finding's risk level changed.

Incidents

Event	Fires when
`incident.created`	An incident was created.
`incident.escalated`	An incident was escalated.
`incident.closed`	An incident was closed.

Policies

Event	Fires when
`policy.published`	A policy was published.
`policy.reviewed`	A policy was reviewed.

Members

Event	Fires when
`member.invited`	A team member was invited.
`member.removed`	A team member was removed.

Evidence

Event	Fires when
`evidence.uploaded`	Evidence was uploaded.
`evidence.deleted`	Evidence was deleted.

Tasks

Event	Fires when
`remediation.completed`	A remediation task was completed.
`remediation.approval_pending`	A remediation task has been awaiting approval past its SLA.

Deadlines

Event	Fires when
`risk.overdue`	A risk treatment passed its due date (risk-sla cron).
`evidence.review_due`	Evidence reached its review date (evidence-review cron).
`access_review.overdue`	An access review passed its due date (access-review-sla cron).
`vendor.questionnaire_overdue`	A vendor questionnaire passed its due date unanswered (questionnaire-sla cron).
`incident.breach_notice_due`	A breach notification an incident owes is due within a week, or past its deadline: recipient and deadline, no incident text (breach-task-sla cron).