Webhooks

Add up to five HTTPS endpoints under Developer API → Event webhooks. Private, local, and non-HTTPS addresses are rejected, and redirects are not followed. New cases are checked about every 30 minutes.

Events

Event	Payload
`case.new`	A `cases` array (up to 100 per delivery) of newly published case summaries
`match.found`	A new `case` with up to five likely counterpart `matches` from the other source, each with a score, confidence tier, evidence score, discrepancies, and evidence
`ping`	Sent by the Send test button

Example delivery

POST /your-endpoint
Content-Type: application/json
X-CaseDock-Event: case.new
X-CaseDock-Signature: t=1700000000,v1=3b1f...

{ "id": "evt_...", "type": "case.new", "created": "2024-01-01T00:00:00.000Z", "data": { "cases": [ ... ] } }

Verify signatures

Verify every request:

Compute an HMAC-SHA256 with your signing secret over timestamp + "." + rawBody.
Compare it to v1 using a constant-time comparison.
Reject timestamps older than five minutes.

const expected = crypto.createHmac('sha256', secret)
  .update(t + '.' + rawBody).digest('hex')

Delivery and retries

Respond with any 2xx status within 8 seconds. An endpoint is disabled automatically after 10 consecutive failed deliveries. Re-enable it from the Developer page.

Match events are ranked research leads, not identifications.

Getting started

Endpoints

Events

Events

Example delivery

Verify signatures

Delivery and retries

​Events

​Example delivery

​Verify signatures

​Delivery and retries

Events

Example delivery

Verify signatures

Delivery and retries