Reference

Webhooks

Push decisions, alerts, and certificate changes to your own systems.

Webhooks pushes decisions and certificate changes into an operator's own systems.

Add a webhook#

Open an agent, then Webhooks, or use the API. The URL must be public https, and an agent can have up to 5.

bash

curl -X POST https://dapp.covergate.app/api/v1/agents/<agent id>/webhooks \
  -H "content-type: application/json" \
  -d '{ "url": "https://example.com/covergate" }'

The response includes a signing secret that starts with whsec_. It is shown once.

Events#

Event	Sent when
`decision`	A live decision is recorded. Dry runs are not sent.
`alert`	An alert is raised, such as a suspicious activity rule
`certificate`	A certificate is registered or revoked

Every delivery is a POST with this body:

json

{
  "event": "decision",
  "agentId": "<agent id>",
  "data": { },
  "sentAt": "<ISO time>"
}

Verify a delivery#

Each delivery has an x-covergate-event header and an x-covergate-signature header. The signature is sha256= followed by the HMAC-SHA256 of the raw body, using your signing secret.

import { verifyWebhook } from "https://dapp.covergate.app/sdk/covergate.mjs";

const valid = await verifyWebhook(secret, rawBody, request.headers.get("x-covergate-signature"));

A failed delivery is retried up to 3 attempts in total. Results are listed on the agent's Webhooks tab and at GET /agents/:id/webhooks.