Webhooks are available on every plan, including the free tier.
Webhooks send a signed JSON POST to your endpoint when subscribed events occur (assessment completed, finding status changed, incident opened, and more).
Every request carries an X-HIPAASherpa-Signature header of the form sha256=<hex> — the HMAC-SHA256 of the raw body using your webhook secret. Recompute it and compare with a constant-time function before trusting the payload.
Rotate from Settings → Webhooks. The new secret signs the next delivery; for 24 hours every delivery also carries X-HIPAASherpa-Signature-Previous — the same body signed with the superseded secret. Verify against either header during that window, then switch your receiver to the new secret and stop accepting the previous one. After 24 hours the previous signature is no longer sent.
Respond with a 2xx within 5 seconds. A failed delivery is retried automatically with exponential backoff, and you can replay any delivery from the delivery log. A webhook that fails repeatedly is auto-suspended until you re-enable it.