Engramma

Webhooks

intermediate

Manage outbound webhooks: list events, delete endpoints, and view delivery history.

Available events

GET/v1/webhooks/events

List all available webhook event types you can subscribe to.

200Response
[
  "regime.changed",
  "consolidation.completed",
  "pattern.limit.warning",
  "pattern.limit.reached",
  "anomaly.detected",
  "export.ready"
]

Delete webhook

DELETE/v1/webhooks/{webhook_id}

Delete a webhook endpoint. No more events will be delivered to this URL.

webhook_idstringrequired

Webhook ID (path parameter).

200Response
{
  "message": "Webhook deleted"
}

List deliveries

GET/v1/webhooks/{webhook_id}/deliveries

View delivery history for a webhook endpoint. Useful for debugging failed deliveries.

webhook_idstringrequired

Webhook ID (path parameter).

limitintegerDefault: 50

Maximum deliveries to return.

200Response
[
  {
    "id": "dlv-uuid",
    "event_type": "consolidation.completed",
    "status_code": 200,
    "success": true,
    "attempts": 1,
    "created_at": "2026-01-20T03:00:00Z"
  },
  {
    "id": "dlv-uuid-2",
    "event_type": "regime.changed",
    "status_code": 500,
    "success": false,
    "attempts": 3,
    "created_at": "2026-01-20T03:15:00Z"
  }
]

Retry policy

AttemptDelayTimeout
1stImmediate10s
2nd1 minute10s
3rd5 minutes10s
4th30 minutes10s
5th (final)2 hours10s

After 5 failed attempts, the delivery is marked as permanently failed.

Webhook signature verification

Every webhook delivery includes an X-Engramma-Signature header containing an HMAC-SHA256 signature:

X-Engramma-Signature: sha256=a1b2c3d4e5f6...

import hmac
import hashlib

def verify_webhook(payload_body: bytes, signature_header: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(),
        payload_body,
        hashlib.sha256
    ).hexdigest()
    received = signature_header.replace("sha256=", "")
    return hmac.compare_digest(expected, received)

Next steps

BillingNotifications