Webhooks

Send Aegis events to your own systems over HTTPS, and let external services start a sync by calling Aegis.

At a glance

Direction	Out of Aegis (event notifications) and into Aegis (sync triggers).
What it sends	`Settings → Webhooks`: one POST per event you subscribe to (for example `incident.created`, `risk.updated`, `evidence.uploaded`). The `Webhook` connector: metric alerts (`alert.triggered`) to one address.
Payload	`Settings → Webhooks` sends `event`, `timestamp`, `deliveryId` and `data`, signed in `X-Aegis-Signature-256`; the fields per event are listed in Webhooks. The connector sends `event`, `timestamp`, `source` (always the same value, naming Aegis) and `data`, signed in `X-Aegis-Signature` when a secret is set.
Credentials and permissions	Your endpoint's HTTPS address and a signing secret. Your receiver checks the HMAC-SHA256 signature of the exact body. Custom headers, such as an `Authorization` header for your gateway, can be added to the connector.
Owner of imported records	Not applicable: nothing is imported. An inbound sync trigger runs the connector's own sync, with that connector's owner rules.
When it runs	At the moment the event happens; a failed `Settings → Webhooks` delivery is retried up to three more times.
Set it up	Event subscriptions in `Settings → Webhooks`; the connector at `/connectors/webhook`; the inbound addresses on the `Webhooks` tab of `Sync Settings`, by people allowed to configure connectors, on a plan that includes the connector.

Good to know

Addresses that resolve to private, loopback or cloud-metadata networks are refused, also after a redirect.
Use X-Aegis-Delivery (the same across retries) to ignore a delivery you already processed.
An inbound endpoint refuses every call with 503 until you set a webhook secret in that connector's settings. After that, a call without a valid signature gets 401: an HMAC-SHA256 of the raw body in X-Hub-Signature-256 (GitHub), X-CS-Signature (CrowdStrike) or X-Webhook-Signature / X-Signature (Azure, Generic), and the secret as clientState in every SharePoint notification.

Example

A new incident, as sent by Settings → Webhooks:

{
  "event": "incident.created",
  "timestamp": "2026-10-12T09:15:02.311Z",
  "deliveryId": "6f1c2a7e-3b9d-4c55-9e1a-2d8f0b7c4e61",
  "data": {
    "id": "cmg8x1v2k0001qz8l4h3d9f2a",
    "title": "Phishing mail reported by finance",
    "status": "OPEN",
    "severity": "HIGH"
  }
}

Where this connects

Every event, header and the signature check in code are in Webhooks; workflow actions that call an address are in Workflows.