Webhooks

Subscribe to events from your Attestly tenant and react in your own systems.

Available events

Event	Fired when
document.created	A new document version is generated.
document.published	A document version is published to the trust center.
drift.detected	A PR introduces drift.
subprocessor.added	A new subprocessor is detected.
subprocessor.removed	A previously detected subprocessor is gone.
dpa.signed	A customer signs your DPA.
aibom.changed	The AIBOM JSON changes.

Setting up

Settings → Webhooks → Add. Provide a URL and pick the events you care about. We'll generate a signing secret you can use to verify HMAC-SHA-256 signatures on incoming requests.

Payload shape

{
  "id": "evt_01J...",
  "type": "drift.detected",
  "createdAt": "2026-05-06T15:00:00Z",
  "tenantId": "tnt_01J...",
  "data": {
    "documentType": "ai_trust_center",
    "prNumber": 482,
    "diff": [
      { "added": "anthropic", "kind": "ai_subprocessor" }
    ]
  }
}

Verifying signatures

import crypto from "node:crypto";

function verifyAttestly(rawBody: string, signature: string, secret: string) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected),
  );
}

Retries

Failed deliveries (any non-2xx response) are retried with exponential backoff for 24 hours. After 24 hours, the event is moved to a dead-letter queue you can replay from the dashboard.