Krusade

Developer Guide / Webhooks

Org verify webhooks

Team owner or admin registers an HTTPS callback. After a verify completes for your org, we POST a signed JSON event to that URL.

Manage endpoints in Dashboard → Organization. Requires an active Team subscription and a verified org DNS domain.

CRUD API

GET
/api/org/webhooks

List active endpoints (secrets redacted).

Session · owner/admin
POST
/api/org/webhooks

Create — body { "url": "https://…" }. Returns secret once (whsec_…).

Session · owner/admin
PATCH
/api/org/webhooks/{id}

Update URL.

Session · owner/admin
DELETE
/api/org/webhooks/{id}

Deactivate.

Session · owner/admin
POST
/api/org/webhooks/{id}/rotate-secret

Rotate HMAC secret (returned once).

Session · owner/admin

URLs must be HTTPS. Literal localhost and private IPs are rejected at registration; delivery uses a DNS-safe HTTP client.

Delivery payload

{
  "event": "verify.event",
  "timestamp": 1710000000,
  "organization_id": "uuid",
  "status": "valid",
  "issuer": "CN=…",
  "errors": []
}

Authenticate with HMAC-SHA256 over the raw body using your webhook secret. Compare the hex digest to the X-Krusade-Signature header. Failed deliveries retry with exponential backoff (up to 5 attempts).

Related