API reference
Webhooks
How Sentinel will notify your systems when something happens.
Coming soon. Webhooks and the
/v1/webhooks subscription endpoint are not in the current API (api/openapi.yaml). This page describes the planned design so you can plan for it. Until then, poll GET /v1/alerts.Sentinel will post to your endpoints when something happens, so your other systems don't need to poll.
Planned event types
| Type | Sent when |
|---|---|
decision.made | A decision is made |
alert.created | An alert is raised |
alert.updated | An alert's status or assignee changes |
screening.match | Screening finds a possible match |
case.closed | A case is closed |
report.filed | A report is filed with your FIU |
Delivery and signatures
Each delivery will be signed so you can check it came from your install, and failed deliveries will be retried with backoff. The Webhooks screen in the console will show a delivery log and let you replay deliveries.
The planned verification: compute an HMAC-SHA256 of t + "." + body with your signing secret, compare it to v1 in the Sentinel-Signature header, and reject deliveries whose t is more than five minutes old.
The payload schema isn't final, so don't build against a specific shape yet.