Webhooks let external systems react to TigerTrust events in real time. Each workspace can register multiple endpoints, each with its own set of subscribed events and an auto-generated signing secret.
Webhooks

​
Create a webhook

Go to Integrations → Webhooks → New endpoint. Provide a name, target URL, and select the events to subscribe to. TigerTrust generates a signing secret and shows it once — save it immediately. Prefer to create webhooks programmatically? See API Reference → Webhooks.

​
Event types

  • certificate.issued
  • certificate.renewed
  • certificate.deployed
  • certificate.revoked
  • certificate.expiring (fires at each threshold in the policy)
  • certificate.expired
  • certificate.discovered
  • ca.created
  • ca.rotated
  • crl.published
  • ocsp.responder_updated
  • agent.connected
  • agent.disconnected
  • agent.enrolled
  • agent.deployment.completed
  • agent.deployment.failed
  • workflow.started
  • workflow.completed
  • workflow.failed
  • approval.requested
  • approval.approved
  • approval.rejected
  • alert.triggered
  • alert.resolved
  • audit.high_risk_event
  • attestation.failed

​
Payload shape

Every delivery is a POST with a JSON body: 
{
  "event": "certificate.issued",
  "id": "evt_2WQZ1abcdefg",
  "timestamp": "2026-08-25T14:22:11.045Z",
  "workspace_id": "ws_9abc123",
  "data": {
    "certificate": {
      "id": "cert_abc123",
      "common_name": "api.example.com",
      "issuer": "TigerTrust Issuing CA",
      "not_before": "2026-08-25T14:22:00Z",
      "not_after": "2027-08-25T14:22:00Z",
      "serial_number": "3E:12:AB:..."
    }
  }
}

​
Signature verification

Every request carries an HMAC-SHA256 signature: 
X-TigerTrust-Signature: sha256=<hex_digest>
X-TigerTrust-Timestamp: 1724599331
X-TigerTrust-Event: certificate.issued
X-TigerTrust-Delivery: dlv_2WQZ1abcdefg
The signed payload is <timestamp>.<raw_body>. Verify in Node.js: 
import crypto from "node:crypto";

function verify(req, secret) {
  const sig = req.headers["x-tigertrust-signature"].replace("sha256=", "");
  const ts  = req.headers["x-tigertrust-timestamp"];
  const body = req.rawBody; // requires raw body middleware
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${ts}.${body}`)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(sig, "hex"),
    Buffer.from(expected, "hex")
  );
}
Reject any request older than 5 minutes to prevent replay attacks.

​
Retry behaviour

AttemptDelay
1Immediate
230 seconds
32 minutes
410 minutes
530 minutes
62 hours
76 hours
812 hours
An attempt is successful on any 2xx response within 10 seconds. After 8 failed attempts the delivery is marked failed. An endpoint with 10 consecutive failures is auto-disabled.

​
Test a delivery

Go to Integrations > Webhooks, click the endpoint, and click Send test. TigerTrust sends a synthetic webhook.test event and shows the response immediately.

​
Delivery history

Go to Integrations > Webhooks > Deliveries and filter by endpoint. Each attempt shows request and response headers, response body, status code, latency, and any error message.

​
Rotating the secret

To rotate the signing secret, delete the endpoint and create a new one. Update your consumers to use the new secret before deleting the old endpoint to avoid a gap in verification.
Rotating the secret invalidates all in-flight signatures. Delete the old endpoint only after all consumers have been updated to the new secret.

API keys

Manage the credentials your systems use to call back into TigerTrust.

Notification channels

Route alerts to Slack, Teams, or PagerDuty without building a webhook consumer.

Workflows

Trigger automations from external events.

Audit logs

Every webhook creation and revocation is captured in audit.