DEVELOPERS

Webhooks

Enterprise event notifications for Runtime Authority -- the planned shape, not a live subscription API yet.

PLANNEDToday, decisions are retrieved by polling GET /v1/decisions/{id} -- see Runtime API.

Rather than requiring every integration to poll for state changes, the planned webhook system notifies your enterprise system directly when something happens inside Runtime Authority. The six events below are the planned taxonomy.

Event taxonomy

IntentReceived

An Intent was received and passed signature verification, before evaluation.

DecisionCompleted

Evaluation finished with an Allow or Deny outcome.

HumanReviewRequested

Evaluation resolved to Human Review and is now pending.

ReceiptIssued

A signed evidence record (planned: an Authorization Receipt) was issued for a decision.

PolicyPublished

A Runtime Policy moved to active and is now being evaluated against Intents.

AuthorityGraphUpdated

A new version of the Authority Graph was published.

Planned payload shape

DecisionCompleted (planned shape)

{
  "event": "DecisionCompleted",
  "event_id": "evt_4c91a2",
  "occurred_at": "2026-08-03T09:14:02.118Z",
  "data": {
    "decision_id": "dec_3a91f0",
    "outcome": "ALLOW",
    "agent_id": "agt_8f2b1c",
    "evidence_id": "ev_7c02d4"
  }
}

HumanReviewRequested (planned shape)

{
  "event": "HumanReviewRequested",
  "event_id": "evt_4c91a3",
  "occurred_at": "2026-08-03T09:14:02.077Z",
  "data": {
    "decision_id": "dec_3a91f2",
    "agent_id": "agt_8f2b1c",
    "reason": "requires_dual_approval"
  }
}

Why polling works today regardless

Nothing about the current Runtime API depends on webhooks existing -- ALLOW and DENY are terminal in the same response you already receive, and Human Review can be tracked by polling the decision until its status resolves. Webhooks remove the need to poll; they don't unlock a capability that's otherwise unavailable.

Other documentation

Getting StartedCreate an organization, register an agent, and get your first Authorization Receipt back.ArchitectureThe full path from an agent's signed intent to a decision and its evidence, component by component.Runtime APIThe Intent API: POST /v1/intents, its three possible outcomes, and the request/response lifecycle.AuthenticationThe Operator Key, per-user roles and permissions, per-developer API keys, and agent certificates.Authority GraphDelegated authority, roles, resources, and approval limits, and how governance becomes machine-readable.Runtime PoliciesHow a policy is compiled, versioned, and deployed, and why that differs from the governance document it came from.Authorization ReceiptsWhy logs aren't enough, the receipt lifecycle, and the planned architecture for independent verification.Evidence VerificationSignature verification, evidence export, and audit workflows against the Evidence Portal today.SDKsThe Python SDK, and the language roadmap for Node.js, Go, Java, .NET, and Rust.Integration ExamplesRotating keys, sending a heartbeat, and retiring an agent, with real SDK code for each.Integration GuidesConnecting Runtime Authority to agent frameworks, model providers, and enterprise systems.Agent RegistrationThe full agent lifecycle: registered, active, suspended, retired, or revoked.API ReferenceEndpoints, schemas, headers, status codes, errors, and versioning.