API EVENTS

Webhooks, delivery and replay protection

Event delivery is signed, versioned and at-least-once. Consumers verify, deduplicate and acknowledge events without trusting transport alone.

Event envelope

{
  "eventId": "evt_...",
  "eventType": "signing_request.completed",
  "occurredAt": "2026-07-19T10:00:00Z",
  "resourceId": "sr_...",
  "tenantId": "tenant_...",
  "data": { "evidenceReceiptId": "evr_..." }
}

Delivery contract

Control	Behavior
Signature	HMAC or asymmetric signature with key ID/version
Freshness	Timestamp tolerance and replay cache
Delivery	At-least-once
Retry	Exponential backoff with maximum retention
Ordering	Not globally guaranteed; resource version included
Deduplication	eventId is stable across retries
Failure queue	Visible to authorized operator with redelivery action

Recommended event types

signing_request.awaiting_approval, signing_request.approved, signing_request.completed, signing_request.failed, asic_package.completed, verification.completed, evidence.renewal_due and provider.health_changed.