VeritomeHelp Centre
/
Browse the guides
Integrations

Webhooks: react to compliance events in real time

Register an HMAC-signed webhook so downstream tools react the moment a system is registered, an obligation changes status, an incident is filed or evidence is verified.

Updated Veritome documentation

Register a webhook under Organisation → API keys & webhooks so downstream tools react in real time instead of polling. Webhooks are an Enterprise feature, the same as API keys, and only an organisation Admin can add or delete one.

Register a webhook

  1. Paste your endpoint URL — a public HTTPS host. Endpoints are checked server-side before anything is sent, so a private address or a non-HTTPS URL is refused.
  2. Click Add. A signing secret is shown once — copy it.
  3. Verify each delivery: the X-Veritome-Signature header carries the HMAC-SHA256 of the raw request body, using that secret, as a bare hex digest. Compare it against the raw body, before parsing, with a timing-safe comparison.

Each delivery is a POST with Content-Type: application/json and a body of { "event", "data", "timestamp" }. A failed delivery is retried, up to three attempts with increasing backoff, and every attempt is recorded — the recent-delivery list shows status codes so you can debug.

The events delivered today

  • system.created — a system is registered through the machine API or the MCP intake tool. Carries the system id, its name and the source (api or mcp).
  • obligation.status_changed — an engine obligation moves status in the app, including when it is sent for review. Carries the obligation and system ids, the title, and the from and to statuses.
  • incident.created — an Art. 73 serious incident is filed. Carries the incident and system ids, the type and the reporting deadline.
  • evidence.verified — an evidence record becomes Verified, when a reviewer approves it or it is renewed. Carries the evidence id and title.

A new webhook subscribes to every event the endpoint offers. Some of the names in that list are reserved for events not yet sent, so build on the four above. A webhook keeps the events it was registered with: if evidence.verified is missing from a webhook's event list in the settings, it was added before that event was offered, so delete it and add it again to subscribe.

Use these to post to Slack when an incident is filed, open a ticket when an obligation changes status, or sync new system registrations into your own systems of record. For the pull-side counterpart — batch ingestion of the whole audit trail — see SIEM ingestion: pull the audit log.