Webhooks: react to compliance events in real time

Register a webhook under Organisation → API keys & webhooks so downstream tools react in real time instead of polling. Webhooks are a Manage-plan feature, the same as API keys.

Register a webhook

1. Paste your endpoint URL — a public HTTPS host. Endpoints are checked server-side before anything is sent, so a private address or a non-HTTPS URL is refused.
2. Click Add. A signing secret is shown once — copy it.
3. Verify each delivery: the X-Veritome-Signature header carries the HMAC-SHA256 of the raw request body, using that secret, as a bare hex digest. Compare it against the raw body, before parsing, with a timing-safe comparison.

Each delivery is a POST with Content-Type: application/json and a body of { "event", "data", "timestamp" }. A failed delivery is retried, up to three attempts with increasing backoff, and every attempt is recorded — the recent-delivery list shows status codes so you can debug.

The four events

• system.created — a system is registered through the machine API or the MCP intake tool. Carries the system id, its name and the source (api or mcp).
• obligation.status_changed — an engine obligation moves status, from the drawer, the board or the API. Carries the obligation and system ids, the title, and the from and to statuses.
• incident.created — an Art. 73 serious incident is filed. Carries the incident and system ids, the type and the reporting deadline.
• evidence.verified — an evidence record flips to Verified, renewals included. Carries the evidence id and title.

Use these to post to Slack when an incident is filed, open a ticket when an obligation changes status, or sync new system registrations into your own systems of record. For the pull-side counterpart — batch ingestion of the whole audit trail — see SIEM ingestion: pull the audit log.