OmegaEngine · Webhooks

Real-time alerts for every security event that matters.

Register HTTPS webhooks to push OmegaEngine security events to any endpoint — Slack incoming webhooks, PagerDuty Events API, your own service. Every signed payload carries a timestamped HMAC signature with replay protection, delivered with exponential-backoff retry and a dead-letter queue.

Delivery Guarantees

🔗

Any HTTPS Endpoint

Point a webhook at Slack, PagerDuty, Datadog, your SIEM, or your own service — anything that accepts an HTTPS POST with a JSON body.

🔁

Retry with Backoff

Failed deliveries are retried up to 5 times with exponential backoff (1s base, 5-minute cap). Exhausted deliveries land in a dead-letter queue.

🔐

Signed Payloads

Configure a secret (16+ characters) and every delivery carries X-Omega-Signature-V2 — a Stripe-style timestamped HMAC-SHA256 that defeats replay.

Create a Webhook

webhook-setup.sh

# Register a webhook for critical security events
curl -X POST https://omegaengine.ai/api/v2/webhooks \
  -H "Content-Type: application/json" \
  -H "x-api-key: $OMEGA_API_KEY" \
  -d '{
    "url": "https://your-app.com/webhooks/omega",
    "events": ["sla.violated", "zero_day.discovered", "incident.escalated"],
    "secret": "whsec_at_least_16_characters"
  }'

# → { ok, webhook: { id, url, events, active, createdAt }, availableEvents }

# List registered webhooks (includes per-webhook delivery/failure counts)
curl -H "x-api-key: $OMEGA_API_KEY" https://omegaengine.ai/api/v2/webhooks

Webhook Payload

Every delivery is an HTTPS POST with this envelope. The signature travels in headers, not the body:

payload.json

{
  "event": "sla.violated",
  "timestamp": "2026-07-14T12:00:00Z",
  "webhookId": "whk_abc123",
  "data": {
    // event-specific payload
  }
}

// Headers on every signed delivery:
//   X-Omega-Signature      sha256=<HMAC-SHA256(body)>            (legacy, body-only)
//   X-Omega-Signature-V2   t=<unix seconds>,v1=<HMAC-SHA256(t.body)>  (verify this one)

Available Events

Event	Description	Severity
`sla.violated`	A safety SLA was violated	Critical
`sla.at_risk`	An SLA is trending toward violation	Warning
`anomaly.detected`	Anomalous decision pattern detected	Warning
`anomaly.spike`	Anomaly scores spiked above baseline	High
`zero_day.discovered`	New attack pattern discovered	Critical
`attack.campaign_detected`	Correlated attack campaign identified	Critical
`drift.regression`	Behavioral drift regression detected	High
`chaos.failure`	Chaos-resilience check failed	High
`contract.violation`	A behavior contract was violated	High
`incident.created`	A security incident was opened	High
`incident.escalated`	An incident was escalated	Critical
`posture.score_drop`	Security posture score dropped	Warning
`scan.completed`	A red-team scan finished	Info
`scan.failed`	A red-team scan failed to complete	Warning
`regulatory.action_required`	A regulatory change needs action	High

Signature Verification

Verify X-Omega-Signature-V2 on every delivery: recompute the HMAC over `${t}.${body}` with your secret, compare in constant time, and reject deliveries older than your tolerance window (recommended: 300 seconds) to defeat replay:

verify.ts

import crypto from "crypto";

// header: X-Omega-Signature-V2 → "t=1720966800,v1=a1b2c3..."
function verifyWebhookV2(body: string, header: string, secret: string, toleranceSec = 300) {
  const parts = new Map(header.split(",").map((p) => p.split("=", 2) as [string, string]));
  const t = Number(parts.get("t"));
  const v1 = parts.get("v1");
  if (!Number.isFinite(t) || !v1) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${body}`)
    .digest("hex");

  const a = Buffer.from(expected, "utf8");
  const b = Buffer.from(v1, "utf8");
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) return false;

  // Reject stale deliveries — anti-replay
  return Math.abs(Math.floor(Date.now() / 1000) - t) <= toleranceSec;
}

API Reference →Audit Trails