API
Webhooks
Receive execution and verdict events over HTTPS webhooks: event types, payload schema, HMAC signature verification, retries, and idempotency.
6 min read
Events
| Event | Fires when |
|---|---|
| execution.queued | An execution is accepted |
| execution.started | A lane begins running cases |
| execution.case_failed | Any individual case fails |
| execution.completed | Terminal verdict reached |
| report.ready | Signed report available |
| lane.degraded | Lane health check failed mid-run |
Payload
jsonjson
{
"id": "evt_01J...",
"type": "execution.completed",
"created_at": "2026-07-14T09:15:32Z",
"data": { "execution_id": "4821", "verdict": "fail", "failed_cases": 1 }
}Verify the signature
typescripttypescript
import { createHmac, timingSafeEqual } from "crypto";
export function verify(rawBody: string, header: string, secret: string) {
const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
const a = Buffer.from(header);
const b = Buffer.from(expected);
return a.length === b.length && timingSafeEqual(a, b);
}noteAlways verify before parsing. Signature is sent in X-Aeon-Signature over the exact raw body.
Delivery guarantees
- At-least-once delivery — deduplicate on event id.
- Retries at 1s, 10s, 1m, 10m, 1h for non-2xx responses.
- Deliveries are disabled after 24 h of consecutive failures.
Run this against a real SDR lane
The tester is a service, not a box. Push a build, reserve a lane, get a verdict.