Open a ticket on failure
Turn compliance.failed into an issue in the tracker your team already watches.
Audit events, delivered where the work happens
Point Ironfang Audit at an endpoint and it sends signed events when an audit completes, a page changes, a rule starts failing or evidence is about to expire. Retried for two days, with a delivery history you can read.
Create a free accountRead the API docs
- HMAC-SHA256 signed
- Eight attempts over two days
- Delivery history
- Rotatable secrets
POST /your/endpoint
Ironfang-Event-Id: ev_01HZY7F8A2
Ironfang-Timestamp: 1756480271
Ironfang-Signature: v1=8a13c09e4f22...
User-Agent: Ironfang-Webhooks/1
{
"type": "compliance.failed",
"audit_id": "aw-2841",
"site": "acme.example",
"pages": 128,
"failing_rules": 1
}One endpoint
Nobody logs into a compliance tool to check
A finding that lives in a dashboard is a finding somebody has to remember to go and look at. The audit that matters is usually the one that ran while everyone was busy with something else.
A webhook puts the event where the work already happens: the tracker, the channel, the deploy pipeline. Ironfang Audit signs it so you can trust it, keeps retrying while your endpoint is down, and records what happened either way.
// verify the signature before trusting the body
const expected =
'v1=' + crypto.createHmac('sha256', secret)
.update(timestamp + '.' + rawBody)
.digest('hex');
if (!crypto.timingSafeEqual(
Buffer.from(expected), Buffer.from(received))) {
return res.status(400).end();
}Capabilities
What the delivery guarantees
The parts that decide whether you can build on it: how it is signed, how hard it tries, and what you can see afterwards.
Signed, and checkable
HMAC-SHA256 over the timestamp and the raw body, sent as v1=<hex>. The version prefix leaves room to change the scheme without breaking receivers.
Retried for two days
One minute, five, thirty, two hours, eight, then a day twice. Eight attempts, long enough to survive an outage somebody fixes the next morning.
Backs off when you ask
A Retry-After on your response is honoured up to a cap, so an endpoint under pressure can slow the retries rather than absorb them.
Aggregates, not floods
One event per audit with counts and a link, rather than one per page. A hundred-page audit is a single delivery.
A delivery history
Status, attempts and an excerpt of your own response, kept per endpoint, with manual retry when you have fixed the thing that broke.
Rotatable secrets
Secrets are shown once and stored sealed, and can be rotated from the API without recreating the endpoint.
Use cases
What teams wire up
Each of these is one event and a handful of lines at the other end.
Post to a channel
Send change.detected where the people who own the page will actually see it.
Gate a deployment
Wait for audit.completed and read the compliance summary before promoting a release.
Archive on completion
Pull the evidence bundle as soon as the audit seals, rather than polling for it.
Catch a skipped run
Act on monitor.skipped, which says why a scheduled run did not start, a usage limit included.
Never lose evidence
Use evidence.expiring to export a bundle before its retention period ends.
Events
Everything Ironfang Audit will tell you about
Subscribe an endpoint to the events you want. Each one is an aggregate for the audit rather than one message per page.
audit.startedAn audit began.audit.completedEvery page finished and the evidence is sealed.audit.partialThe audit finished with some pages incomplete.audit.failedThe audit could not complete.change.detectedA page changed by more than its monitor policy allows.compliance.failedA rule that was passing is now failing.monitor.skippedA scheduled slot was skipped, with the reason, such as a usage limit.evidence.expiringHosted evidence expires soon and no export holds a copy.
Prefer the evidence itself rather than a notification? See export to your own storage.
Pricing
Webhooks are included on every account
There is no per-delivery charge and no add-on. What counts is the pages you capture, beyond the free monthly allowance; getting the results out is part of the product. Evidence integrity and delivery behaviour are identical on every account, free or paid.
Questions
Before you integrate
The details that decide whether this fits, without reading the whole reference first.
- How do I verify a delivery came from Ironfang Audit?
- Each request carries an Ironfang-Signature header of the form v1=<hex>. It is an HMAC-SHA256 over the timestamp, a full stop, and the raw request body, keyed with your endpoint secret. Compare it with a constant-time check, and reject a timestamp that is too old to be one of yours.
- What happens if my endpoint is down?
- It is retried on a ladder of one minute, five minutes, thirty minutes, two hours, eight hours and then a day, twice, which is eight attempts across about two days. That is long enough for somebody who noticed in the morning to fix it.
- Can I ask for a slower retry?
- Yes. A Retry-After header on your response is honoured, up to a cap, so an endpoint under load can push the next attempt back rather than being hammered.
- What counts as a successful delivery?
- Any 2xx. Anything else is a failure, and the first part of your response body is kept with the delivery record so you can see what your endpoint actually said when it rejected it.
- Will I get one webhook per page?
- No, and that is deliberate. Events are aggregates: one per audit rather than one per page, carrying counts and a link to the detail. A hundred-page audit is one delivery, not a hundred.
- How do I rotate a secret without missing deliveries?
- Rotate from the API when you need to. The secret is shown once when it is minted and stored sealed, so treat it the way you would any other credential and keep your own copy at the point you create it.
- Can I see what was delivered?
- Yes. Every endpoint keeps a delivery history with the status, the response excerpt and the attempts, and a delivery can be retried by hand from the API.
Less to operate. More to ship.
Wire up your first endpoint
Create an account, add a site and point an endpoint at it. The audit that triggers the first event is inside your free monthly allowance.
Webhooks are included on every account, with no per-delivery charge and no card required to start.