Sent by the Apologist Agent platform to your configured webhook URL whenever a subscribed agent event occurs. Your endpoint must respond with any 2xx status to acknowledge; non-2xx responses are logged and are not retried.
Verify the request before trusting it. Two security modes are supported per notification:
Signature mode (recommended): X-Webhook-Signature carries
sha256=<hex>, the HMAC-SHA256 of "{X-Webhook-Timestamp}.{rawBody}"
keyed by your secret. Reject stale timestamps and compare in constant
time.
Shared-secret mode: X-Webhook-Secret carries the plaintext
secret to compare against your stored value.
See WEBHOOKS.md for full verification examples.
Signature mode only. sha256=<hex> HMAC-SHA256 of ā{timestamp}.{rawBody}ā keyed by the notification secret.
Shared-secret mode only. The plaintext shared secret.
Present when the event is tied to a prompt. Includes the prompt and response plus automations and tags arrays. Shape mirrors the prompt API object.
Present alongside channel when the channel has a platform.
Present for cta_trigger and cta_click events.
Present for guardrail_trigger events.
Present for CTA/guardrail events that ran an evaluation.
Result of an evaluation run for CTA/guardrail events.