How do I verify a delivery came from Ironfang Audit?

Each request carries an Auditwolf-Signature header of the form v1= . It is an HMAC-SHA256 over the timestamp, a full stop, and the raw request body, keyed with your endpoint secret. Compare it with a constant-time check, and reject a timestamp that is too old to be one of yours.

What happens if my endpoint is down?

It is retried on a ladder of one minute, five minutes, thirty minutes, two hours, eight hours and then a day, twice, which is eight attempts across about two days. That is long enough for somebody who noticed in the morning to fix it.

Can I ask for a slower retry?

Yes. A Retry-After header on your response is honoured, up to a cap, so an endpoint under load can push the next attempt back rather than being hammered.

What counts as a successful delivery?

Any 2xx. Anything else is a failure, and the first part of your response body is kept with the delivery record so you can see what your endpoint actually said when it rejected it.

Will I get one webhook per page?

No, and that is deliberate. Events are aggregates: one per audit rather than one per page, carrying counts and a link to the detail. A hundred-page audit is one delivery, not a hundred.

How do I rotate a secret without missing deliveries?

Rotate from the API when you need to. The secret is shown once when it is minted and stored sealed, so treat it the way you would any other credential and keep your own copy at the point you create it.

Can I see what was delivered?

Yes. Every endpoint keeps a delivery history with the status, the response excerpt and the attempts, and a delivery can be retried by hand from the API.

Webhooks

Audit events, delivered where the work happens

Point Ironfang Audit at an endpoint and it sends signed events when an audit completes, a page changes, a rule starts failing or evidence is about to expire. Retried for two days, with a delivery history you can read.

Create a free account Read the API docs

HMAC-SHA256 signed
Eight attempts over two days
Delivery history
Rotatable secrets

POST /your/endpoint
Auditwolf-Event-Id:   ev_01HZY7F8A2
Auditwolf-Timestamp:  1756480271
Auditwolf-Signature:  v1=8a13c09e4f22...
User-Agent:           Auditwolf-Webhooks/1

{
  "type": "compliance.failed",
  "audit_id": "aw-2841",
  "site": "acme.example",
  "pages": 128,
  "failing_rules": 1
}

One endpoint

Nobody logs into a compliance tool to check

A finding that lives in a dashboard is a finding somebody has to remember to go and look at. The audit that matters is usually the one that ran while everyone was busy with something else.

A webhook puts the event where the work already happens: the tracker, the channel, the deploy pipeline. Ironfang Audit signs it so you can trust it, keeps retrying while your endpoint is down, and records what happened either way.

// verify the signature before trusting the body
const expected =
  'v1=' + crypto.createHmac('sha256', secret)
    .update(timestamp + '.' + rawBody)
    .digest('hex');

if (!crypto.timingSafeEqual(
      Buffer.from(expected), Buffer.from(received))) {
  return res.status(400).end();
}

Capabilities

What the delivery guarantees

The parts that decide whether you can build on it: how it is signed, how hard it tries, and what you can see afterwards.

Signed, and checkable

HMAC-SHA256 over the timestamp and the raw body, sent as v1=<hex>. The version prefix leaves room to change the scheme without breaking receivers.

Retried for two days

One minute, five, thirty, two hours, eight, then a day twice. Eight attempts, long enough to survive an outage somebody fixes the next morning.

Backs off when you ask

A Retry-After on your response is honoured up to a cap, so an endpoint under pressure can slow the retries rather than absorb them.

Aggregates, not floods

One event per audit with counts and a link, rather than one per page. A hundred-page audit is a single delivery.

A delivery history

Status, attempts and an excerpt of your own response, kept per endpoint, with manual retry when you have fixed the thing that broke.

Rotatable secrets

Secrets are shown once and stored sealed, and can be rotated from the API without recreating the endpoint.

Use cases

What teams wire up

Each of these is one event and a handful of lines at the other end.

Open a ticket on failure

Turn compliance.failed into an issue in the tracker your team already watches.

Post to a channel

Send change.detected where the people who own the page will actually see it.

Gate a deployment

Wait for audit.completed and read the compliance summary before promoting a release.

Archive on completion

Pull the evidence bundle as soon as the audit seals, rather than polling for it.

Watch your own quota

Act on quota.threshold_reached before an audit is blocked rather than after.

Never lose evidence

Use evidence.expiring to export a bundle before its retention period ends.

Events

Everything Ironfang Audit will tell you about

Subscribe an endpoint to the events you want. Each one is an aggregate for the audit rather than one message per page.

audit.startedAn audit began.
audit.completedEvery page finished and the evidence is sealed.
audit.partialThe audit finished with some pages incomplete.
audit.failedThe audit could not complete.
change.detectedA page changed by more than its monitor policy allows.
compliance.failedA rule that was passing is now failing.
monitor.skippedA scheduled slot was skipped, with the reason.
quota.threshold_reachedCredit use crossed a threshold on your plan.
audit.quota_blockedAn audit the plan could not pay for; nothing was captured.
evidence.expiringHosted evidence expires soon and no export holds a copy.

Prefer the evidence itself rather than a notification? See export to your own storage.

Pricing

Webhooks are included on every plan

There is no per-delivery charge and no add-on. You are charged for the pages you capture; getting the results out is part of the product. Evidence integrity and delivery behaviour are identical on the free plan and every paid one.

See Ironfang Audit pricing Compare with other providers

Questions

Before you integrate

The details that decide whether this fits, without reading the whole reference first.

How do I verify a delivery came from Ironfang Audit?: Each request carries an Auditwolf-Signature header of the form v1=<hex>. It is an HMAC-SHA256 over the timestamp, a full stop, and the raw request body, keyed with your endpoint secret. Compare it with a constant-time check, and reject a timestamp that is too old to be one of yours.
What happens if my endpoint is down?: It is retried on a ladder of one minute, five minutes, thirty minutes, two hours, eight hours and then a day, twice, which is eight attempts across about two days. That is long enough for somebody who noticed in the morning to fix it.
Can I ask for a slower retry?: Yes. A Retry-After header on your response is honoured, up to a cap, so an endpoint under load can push the next attempt back rather than being hammered.
What counts as a successful delivery?: Any 2xx. Anything else is a failure, and the first part of your response body is kept with the delivery record so you can see what your endpoint actually said when it rejected it.
Will I get one webhook per page?: No, and that is deliberate. Events are aggregates: one per audit rather than one per page, carrying counts and a link to the detail. A hundred-page audit is one delivery, not a hundred.
How do I rotate a secret without missing deliveries?: Rotate from the API when you need to. The secret is shown once when it is minted and stored sealed, so treat it the way you would any other credential and keep your own copy at the point you create it.
Can I see what was delivered?: Yes. Every endpoint keeps a delivery history with the status, the response excerpt and the attempts, and a delivery can be retried by hand from the API.

Less to operate. More to ship.

Wire up your first endpoint

Create an account, add a site and point an endpoint at it. The audit that triggers the first event is inside your free credits.

Create a free account Read the API reference

Webhooks are included on every plan, with no per-delivery charge and no card required to start.