Webhooks

Outbound webhooks are Org plan. An organisation registers endpoint URLs, and the platform POSTs JSON to them over HTTPS when something happens.

The events

Five events are currently emitted, all project-scoped:

Event	Fires when
project.update.published	An update is published
project.evidence.created	Evidence is recorded
project.evidence.updated	An evidence record changes
project.evidence.deleted	Evidence is removed
project.milestone.reached	A milestone is completed

Security layers

An unprotected endpoint is a URL receiving JSON. Three independent layers may be applied, and they combine. Only the first is enabled by default.

HMAC signing — enabled by default. Adds an X-ANW-Signature header. The secret is generated and returned once at creation; it must be stored at that point, or signing disabled and reconfigured. Verify the signature rather than relying on the source address.

Custom headers — static headers required by the receiver, most commonly an Authorization header. Values are encrypted at rest and never returned, so they cannot be retrieved from the platform.

Custom body parameters — static fields merged into the payload root, for receivers expecting a token in the body rather than a header. Handled identically: encrypted, and never returned.

Delivery and failure handling

Outbound webhook endpoints, with their signing and delivery stateOpen /a/settings/integrations in the app

×

Dispatch is fire-and-forget: it does not block, and does not fail the action that triggered it. Publishing an update succeeds regardless of whether the endpoint responded, so a receiver outage does not affect platform users.

Failures are not notified, but they are recorded. The endpoint list reports each endpoint’s status and last delivery. The information must be checked; it is not pushed.

Repeated failures automatically disable the endpoint. A receiver that is unavailable for a sustained period ceases to be called, and re-enabling it is a manual action. Check the status column following any outage on the receiving side.

An organisation can register up to ten endpoints.

Send a test ping before relying on an endpoint. It is the least costly way to detect an incorrect URL, header or signature check. The screen also includes a “How to verify deliveries” section for the implementer of the receiver.

WebhooksSettings → Integrations