Webhooks let Authensor push safety events to your existing incident response tools in real time. When a policy denies an action, Aegis detects a prompt injection, or Sentinel flags anomalous behavior, a webhook delivers the event to Slack, PagerDuty, or any HTTP endpoint within seconds.
Authensor's control plane supports configuring webhook endpoints per event type. You register an endpoint URL, select which event categories trigger it, and optionally set a shared secret for payload verification.
Event categories include: policy denials, escalations requiring human approval, content safety detections, behavioral anomalies, and system health events.
Webhook payloads follow a consistent JSON structure containing the event type, timestamp, agent ID, a summary of the event, and relevant details. For policy denials, the details include the action that was attempted, the policy rule that blocked it, and the evaluation receipt ID.
Keep payloads compact. Include enough context for triage but link to the full audit record rather than embedding it. A webhook payload should be under 4 KB.
Implement retry logic for failed deliveries. Authensor retries with exponential backoff, making up to five attempts over a 15-minute window. After exhausting retries, the failed delivery is logged for manual review.
Use a delivery queue backed by PostgreSQL or Redis to ensure webhooks survive process restarts. Authensor's control plane queues webhook deliveries in the database and processes them asynchronously.
Sign webhook payloads using HMAC-SHA256 with the shared secret. The receiving endpoint verifies the signature before processing the payload. This prevents attackers from sending forged safety events.
Serve webhook endpoints over HTTPS only. Reject HTTP endpoints during configuration.
Slack: Post safety alerts to a dedicated channel. Format the payload as a Slack Block Kit message with action buttons for acknowledging or investigating the event.
PagerDuty: Route high-severity events (like repeated policy denials from a single agent) to on-call responders. Map event severity to PagerDuty urgency levels.
Custom dashboards: Push events to a websocket-backed dashboard for real-time visibility into safety operations across your agent fleet.
Keep webhook endpoints lightweight. Heavy processing should happen asynchronously after acknowledging receipt.
Explore more guides on AI agent safety, prompt injection, and building secure systems.
View All Guides