Receive a webhook event
POST
EthicsPortal sends a signed POST request to your HTTPS endpoint when a report is created or changes, or when a deadline is close or has passed. The destination must be public. Verify HMAC-SHA256(timestamp + “.” + raw request body), timestamp freshness and event ID. At-least-once delivery; no ordering guarantee.
Parameters
Section titled “Parameters”Header Parameters
Section titled “Header Parameters”X-EthicsPortal-Event-Id
required
string
X-EthicsPortal-Signature
required
string
t=<Unix seconds>,v1=<hex HMAC-SHA256>
Request Bodyrequired
Section titled “Request Bodyrequired”Media typeapplication/json
One of:
Report lifecycle event
object
id
required
string
type
required
string
created_at
required
string format: date-time
data
required
object
id
required
string
organization_id
required
string
status
required
string
assigned
required
boolean
created_at
required
string format: date-time
acknowledged_at
required
string | null format: date-time
feedback_given_at
required
string | null format: date-time
closed_at
required
string | null format: date-time
acknowledgment_due_at
required
string format: date-time
feedback_due_at
required
string format: date-time
acknowledgment_overdue
required
boolean
feedback_overdue
required
boolean
Deadline event
object
id
required
string
type
required
string
created_at
required
string format: date-time
data
required
object
report_id
required
string
organization_id
required
string
deadline_type
required
string
deadline_at
required
string format: date-time
Test event
object
id
required
string
type
required
string
created_at
required
string format: date-time
data
required
object
organization_id
required
string
Responses
Section titled “Responses”Receipt accepted. Process asynchronously and deduplicate by event ID.
default
Section titled “default”Non-2xx responses are retried; redirects are never followed.