Signed, and checkable
HMAC-SHA256 over the timestamp and the raw body, sent as v1=<hex>. The version prefix leaves room to change the scheme without breaking receivers.
Webhooks
Audit events, delivered where the work happens
Point Auditwolf at an endpoint and it sends signed events when an audit completes, a page changes, a rule starts failing or evidence is about to expire. Retried for two days, with a delivery history you can read.
Create a free accountRead the API docs
- HMAC-SHA256 signed
- Eight attempts over two days
- Delivery history
- Rotatable secrets
POST /your/endpoint
Auditwolf-Event-Id: ev_01HZY7F8A2
Auditwolf-Timestamp: 1756480271
Auditwolf-Signature: v1=8a13c09e4f22...
User-Agent: Auditwolf-Webhooks/1
{
"type": "compliance.failed",
"audit_id": "aw-2841",
"site": "acme.example",
"pages": 128,
"failing_rules": 1
}One endpoint
Nobody logs into a compliance tool to check
A finding that lives in a dashboard is a finding somebody has to remember to go and look at. The audit that matters is usually the one that ran while everyone was busy with something else.
A webhook puts the event where the work already happens: the tracker, the channel, the deploy pipeline. Auditwolf signs it so you can trust it, keeps retrying while your endpoint is down, and records what happened either way.
// verify the signature before trusting the body
const expected =
'v1=' + crypto.createHmac('sha256', secret)
.update(timestamp + '.' + rawBody)
.digest('hex');
if (!crypto.timingSafeEqual(
Buffer.from(expected), Buffer.from(received))) {
return res.status(400).end();
}Capabilities
What the delivery guarantees
The parts that decide whether you can build on it: how it is signed, how hard it tries, and what you can see afterwards.
Retried for two days
One minute, five, thirty, two hours, eight, then a day twice. Eight attempts, long enough to survive an outage somebody fixes the next morning.
Backs off when you ask
A Retry-After on your response is honoured up to a cap, so an endpoint under pressure can slow the retries rather than absorb them.
Aggregates, not floods
One event per audit with counts and a link, rather than one per page. A hundred-page audit is a single delivery.
A delivery history
Status, attempts and an excerpt of your own response, kept per endpoint, with manual retry when you have fixed the thing that broke.
Rotatable secrets
Secrets are shown once and stored sealed, and can be rotated from the API without recreating the endpoint.
Use cases
What teams wire up
Each of these is one event and a handful of lines at the other end.
Open a ticket on failure
Turn compliance.failed into an issue in the tracker your team already watches.
Post to a channel
Send change.detected where the people who own the page will actually see it.
Gate a deployment
Wait for audit.completed and read the compliance summary before promoting a release.
Archive on completion
Pull the evidence bundle as soon as the audit seals, rather than polling for it.
Watch your own quota
Act on quota.threshold_reached before an audit is blocked rather than after.
Never lose evidence
Use evidence.expiring to export a bundle before its retention period ends.
Events
Everything Auditwolf will tell you about
Subscribe an endpoint to the events you want. Each one is an aggregate for the audit rather than one message per page.
audit.startedAn audit began.audit.completedEvery page finished and the evidence is sealed.audit.partialThe audit finished with some pages incomplete.audit.failedThe audit could not complete.change.detectedA page changed by more than its monitor policy allows.compliance.failedA rule that was passing is now failing.monitor.skippedA scheduled slot was skipped, with the reason.quota.threshold_reachedCredit use crossed a threshold on your plan.audit.quota_blockedAn audit the plan could not pay for; nothing was captured.evidence.expiringHosted evidence expires soon and no export holds a copy.
Prefer the evidence itself rather than a notification? See export to your own storage.
Pricing
Webhooks are included on every plan
There is no per-delivery charge and no add-on. You are charged for the pages you capture; getting the results out is part of the product. Evidence integrity and delivery behaviour are identical on the free plan and every paid one.
Questions
Before you integrate
The details that decide whether this fits, without reading the whole reference first.
How do I verify a delivery came from Auditwolf?
Each request carries an Auditwolf-Signature header of the form v1=<hex>. It is an HMAC-SHA256 over the timestamp, a full stop, and the raw request body, keyed with your endpoint secret. Compare it with a constant-time check, and reject a timestamp that is too old to be one of yours.
What happens if my endpoint is down?
It is retried on a ladder of one minute, five minutes, thirty minutes, two hours, eight hours and then a day, twice, which is eight attempts across about two days. That is long enough for somebody who noticed in the morning to fix it.
Can I ask for a slower retry?
Yes. A Retry-After header on your response is honoured, up to a cap, so an endpoint under load can push the next attempt back rather than being hammered.
What counts as a successful delivery?
Any 2xx. Anything else is a failure, and the first part of your response body is kept with the delivery record so you can see what your endpoint actually said when it rejected it.
Will I get one webhook per page?
No, and that is deliberate. Events are aggregates: one per audit rather than one per page, carrying counts and a link to the detail. A hundred-page audit is one delivery, not a hundred.
How do I rotate a secret without missing deliveries?
Rotate from the API when you need to. The secret is shown once when it is minted and stored sealed, so treat it the way you would any other credential and keep your own copy at the point you create it.
Can I see what was delivered?
Yes. Every endpoint keeps a delivery history with the status, the response excerpt and the attempts, and a delivery can be retried by hand from the API.
Wire up your first endpoint
Create an account, add a site and point an endpoint at it. The audit that triggers the first event is inside your free credits.
Webhooks are included on every plan, with no per-delivery charge and no card required to start.