Webhooks

Webhooks push decision and case activity into your own systems. You register the endpoint under Settings → Webhooks.

Event types

Event	When
`decision.created`	A decision was produced
`case.created_from_workflow`	A workflow rule opened a case
`case.created_manually`	A case was opened by hand
`case.updated`	A case’s status, outcome or assignment changed
`case.decisions_updated`	Decisions were added to or removed from a case
`case.decision_reviewed`	A decision was reviewed and concluded
`case.comment_created`	A note was added to a case
`case.file_created`	A file was attached to a case
`case.tags_updated`	A case’s tags changed
`case.assigned`	A case was given to somebody — automatically or by hand
`case.escalated`	A case passed its answer time
`decision.review_required`	An outcome other than approve: somebody has to look at it

The three that alert a person

The last three exist to alert whoever works the queue, not to move data into another system. Slack, Teams, email and SMS connections are driven from these events too: Settings → Integrations. case.assigned is separate from case.updated. An analyst who wants to be told when work lands on their plate should not have to subscribe to every edit of every case to find out — a channel that receives everything gets muted, and after that nothing is heard at all. decision.review_required is likewise separate from decision.created: the overwhelming majority of decisions are approvals, and a channel that receives all of them is a channel nobody reads.

decision.review_required does not look at the request’s with_decision_webhooks field. That field is the caller saying whether they want their own webhooks; a caller must not be able to silence the compliance team’s alerting by omitting a field from their payload.

The escalation sweep records the breach and raises this event — but it still does not reassign or reroute. Telling somebody is not the same as deciding who picks it up.

Verifying the signature

Krino follows the Standard Webhooks format. Every request carries three headers:

Header	Contents
`webhook-id`	Unique id for the request
`webhook-timestamp`	Unix timestamp in seconds
`webhook-signature`	`v1,<base64 HMAC-SHA256>`

The signed string is:

{webhook-id}.{webhook-timestamp}.{raw body}

Sign the raw body — parsing the JSON and re-serialising it will not match. In most frameworks, reading the body raw takes an explicit setting.

Node.js example

import crypto from 'node:crypto';

function verify(headers, rawBody, secret) {
  const id = headers['webhook-id'];
  const ts = headers['webhook-timestamp'];
  const sig = headers['webhook-signature'];

  // Reject replays of an old request.
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  const expected = crypto
    .createHmac('sha256', Buffer.from(secret, 'base64'))
    .update(`${id}.${ts}.${rawBody}`)
    .digest('base64');

  // Constant-time compare: plain equality leaks timing.
  return sig
    .split(' ')
    .some(part => crypto.timingSafeEqual(
      Buffer.from(part.replace(/^v1,/, '')),
      Buffer.from(expected),
    ));
}

What your endpoint must honour

Answer quickly

Return 2xx and queue the work. Do not do anything slow inside the request.

Tolerate duplicates

The same event can arrive more than once. Store webhook-id and ignore ids you have already seen.

Do not rely on ordering

Events may not arrive in the order they were produced. Decide from the timestamp in the body, not from arrival order.

Retries

If your endpoint returns anything other than 2xx or times out, Krino retries with increasing intervals. Endpoints that keep failing are surfaced under Settings → Webhooks.

Getting started

Platform

Decisions

Data and events

Signals and screening

Self-hosting

Event types

The three that alert a person

Verifying the signature

Node.js example

What your endpoint must honour

Retries

​Event types

​The three that alert a person

​Verifying the signature

​Node.js example

​What your endpoint must honour

​Retries

Event types

The three that alert a person

Verifying the signature

Node.js example

What your endpoint must honour

Retries