Webhooks

Subscribe to instant push notifications for revocation events. Each payload is HMAC-signed with your subscription secret and Ed25519-signed by the operator.

Create subscription

Receives revocation.opened, revocation.reinstated, revocation.appeal_decided. View events · Operator public key

Your subscriptions

URL	Events	Status	Last result
Loading…

Verifying a delivery

Every request carries two signatures:

HMAC-SHA256 per subscription — header X-WAB-Webhook-Signature: t=<unix>,v1=<hex>. Recompute over ${'`${t}.${rawBody}`'} with your secret.
Ed25519 operator signature — header X-WAB-Operator-Signature + embedded signature.value. Fetch the public key at /api/operator-key.json and verify over the RFC 8785 canonicalisation of the envelope minus the signature field.