Subscribe to Webhooks
Receive real-time notifications when attestations and compliance checks complete
This guide covers how to receive, verify, and process webhook events from Clossir. Webhooks deliver real-time notifications when attestations are created, compliance checks complete, and policies change — without polling.
Prerequisites
- An organization with operations in progress (Onboard an Organization)
- A publicly reachable HTTPS endpoint to receive webhook deliveries
1. Available event channels
Clossir delivers events across seven channels organized in two families:
Attestation channels
Compliance channels
For the full payload schemas, see the API Reference.
2. Configure your endpoint
Webhook subscriptions are configured through the Clossir dashboard. Navigate to your organization settings and add your webhook endpoint URL.
Your endpoint must:
- Accept
POSTrequests over HTTPS - Return a
2xxstatus code within 10 seconds to acknowledge receipt - Process events idempotently — the same event may be delivered more than once
There is no webhook subscription management API at this time. All webhook configuration is done through the dashboard.
3. Payload structure
Every webhook delivery is a JSON payload containing the event data. Here is a representative
signum.attestation.created payload:
Each event type has its own payload schema. See the API Reference for the full catalog.
4. Tracing headers
Every webhook delivery includes W3C Trace Context headers for distributed tracing:
Use these headers to correlate webhook deliveries with your internal request traces:
5. Verify the payload
Webhook signature verification is coming soon. Until the verification mechanism is available, we recommend allowlisting the Clossir delivery IP range and validating payloads against the expected schema.
When signature verification launches, each delivery will include a signature header that you can verify using your webhook secret to confirm the payload originated from Clossir.
6. Build your webhook handler
Here is a complete webhook handler that receives, validates, and processes events:
7. Correlate with commands
When you issue a command that returns a resource ID in its 202 response (like
attestationId, assetId, or checkId), you can match that ID to the corresponding
webhook payload:
See Async Operations for the full correlation pattern.
Handle failures
- Retries: If your endpoint returns a non-2xx status or times out, Clossir retries delivery with exponential backoff.
- Idempotency: Always process events idempotently. Use the event’s unique ID
(
attestationId,checkId, etc.) as a deduplication key. - Ordering: Events may arrive out of order. Use the
timestampfield to determine the sequence of events for a given resource.
Reference
- API Reference — full catalog of event types and payload schemas
- Async Operations — polling and webhook correlation
Next steps
- Getting Started — back to the overview
- API Reference — the full operation catalog