Platform

Webhooks

CoreLink emits webhook events for key lifecycle transitions: secret created/updated/rotated/deleted, session started/ended, approval granted/denied, and compliance violation detected. Each webhook endpoint is configured with a URL, HMAC-SHA256 signing secret, and event filter.

Delivery uses at-least-once semantics with exponential backoff (5 retries over 30 minutes). Failed deliveries are logged and retryable from the admin UI. Payloads are JSON and include a X-CoreLink-Signature-256 header for verification.

Webhooks screenshot

Key Configuration

  • Endpoint URL
  • Signing secret
  • Event filter (comma-separated event types)
  • Timeout (seconds)
  • TLS verification
All documentation Question about this? Talk to us