Webhooks and Notifications
Stream visitor, screening, adjudication, and audit-related events into your systems when outbound webhooks are enabled for your environment.
Event Coverage
Outbound webhooks are a configured feature. Once enabled for your tenant, configure one or more endpoints for the event types below.
- visitor.checkin
- visitor.checkout
- visitor.approved
- visitor.denied
- screening.decision
- screening.completed
- screening.escalated
- adjudication.disposition_changed
- evidence.ready
- session.under_review
- badge.printed
Delivery Lifecycle
Deliveries move through pending, delivering, delivered, and failed states. Retries are controlled by max_retries on each endpoint. If outbound webhooks are not enabled, endpoint management is unavailable and events are not delivered.
Signed Payloads
Validate X-Spusa-Signature and X-Spusa-Timestamp before processing webhook payloads.
Structured Event Body
Each delivery includes event type, organization id, and a data object with event payload details.
Endpoint Operations
Manage endpoint registration, status, and secret rotation through admin webhook routes after SecurePoint enables outbound delivery for the tenant.
Verification Example
const body = await request.text();
const signature = request.headers.get('X-Spusa-Signature');
const timestamp = request.headers.get('X-Spusa-Timestamp');
const payloadToSign = `${timestamp}.${body}`;
// Compute expected HMAC-SHA256 and compare using timing-safe checks
For production, keep webhook secrets in server-side secret storage and reject stale timestamps.
Need help wiring an integration?
We can provide event catalogs, payload samples, and testing guidance for your systems.
Talk to the team