Webhook Integrations - HiddenLayer Docs

A webhook allows communication between applications by allowing a server to push data to a client when events occur. Using a webhook integration allows HiddenLayer to send new detection data to your application. A detection is a grouping of convictions. A conviction is when HiddenLayer has determined that a malicious event, or set of malicious events, has taken place.

Requirements

To enable a webhook integration, you need:

Administrator access to the HiddenLayer Console (or have an administrator configure it for you).
A URL for your webhook.

Configure Webhook

The configuration settings allow you to submit models to the HiddenLayer SaaS AI Supply Chain Security service. Scan results are posted in the HiddenLayer Console.

In the HiddenLayer Console, go to Settings > Integrations.
For Webhook, click the menu (three vertical dots).
Select Configure Integration.
Enter a unique name for the webhook.
Enter the webhook URL.
Select the Webhook Method (POST or PUT).
To disable TLS verification, select the Disable TLS Verification checkbox.
To add a custom header.
- Click + Add Header.
- Enter the header and the value.
- If this header is a secret, select the Is Secret checkbox.
- Custom headers supports Auth headers.
Under Data Sources, select one or more data sources to deliver to this webhook. See Data Formats for what each one exports.
Click Submit to save the webhook integration.

Disable Webhook

You can disable a webhook to stop the integration while retaining the webhook configuration for later use.

In the Console, on the Settings > Integrations page, edit the webhook.
- Click the menu for the webhook (three vertical dots), then select Configure Integration.
Deselect the Enabled checkbox.
Click Submit.

Delete Webhook

You can delete a webhook when it is no longer needed.

In the Console, on the Settings > Integrations page, delete the webhook.
- Click the menu for the webhook (three vertical dots), then select Delete.
- A message displays, asking you to confirm deleting the webhook.
Click Delete.

Data Formats

Four different data sources can be exported via a single webhook configuration. A minimum of one data source must be enabled. The following provides an example of what will be exported for each data source.

Runtime Security Convictions

{
    "attributable_event_id": "0c7fe87b-9bc6-4651-bf2c-80f8376817d1",
    "concluding_event_id": "0c7fe87b-9bc6-4651-bf2c-80f8376817d1",
    "conviction_id": "b53bc9c8-e5cc-4bd8-a3bf-98576de4cb71",
    "conviction_timestamp": 1765915610241793453,
    "detection_category": "Guardrail Activation",
    "engine_name": "llmproxy",
    "mitre": {
      "Tactic": {
        "Name": "Impact",
        "SrcUrl": "https://atlas.mitre.org/tactics/AML.TA0011",
        "UID": "AML.TA0011"
      },
      "Technique": {
        "Name": "External Harms",
        "SrcUrl": "https://atlas.mitre.org/techniques/AML.T0048",
        "UID": "AML.T0048"
      }
    },
    "requester_id": "gpburdell",
    "sensor_id": "7af8d1a8-742b-4400-b152-5ee702885b2f",
    "severity": "Low",
    "source": "aidr",
    "tactic": "AML.TA0011",
    "technique": "AML.T0048",
    "tenant_id": "b2774567-7610-437a-1111-da6ec36cc347"
}

Supply Chain Scans

{
  "scan_result_summary": {
    "detection_categories": [
      "Graph Payload"
    ],
    "detection_count": 3,
    "end_time": "2025-12-16T20:01:16.010934055Z",
    "file_count": 3,
    "files_with_detections_count": 3,
    "has_genealogy": false,
    "inventory": {
      "model_id": "00000000-0000-0000-0000-000000000000",
      "model_name": "multiple onnx",
      "model_source": null,
      "model_version": "1",
      "model_version_id": "00000000-0000-0000-0000-000000000000",
      "origin": "Local File System",
      "request_source": "UI Upload",
      "requesting_entity": "gpburdell@hiddenlayer.com"
    },
    "scan_error": null,
    "scan_id": "3246d37b-b211-4983-80a8-86851c484fa8",
    "severity": "high",
    "signing": null,
    "start_time": "2025-12-16T20:01:10.916810185Z",
    "status": "done",
    "summary": {
      "detection_count": 3,
      "file_count": 3,
      "severity": "high",
      "files_with_detections_count": 3,
      "detection_categories": [
        "Graph Payload"
      ],
      "files_failed_to_scan": 0,
      "unknown_files": 0
    },
    "version": "25.12.1"
  }
}

Runtime Policy Outcomes

See Runtime Policy Outcomes for a full description of fields.

{
  "manifest": {
    "tenant_id": "b2774567-7610-437a-1111-da6ec36cc347",
    "correlation_id": "12f6708f-88bf-455e-b7fb-c6485d6a93d1",
    "event_id": "0c7fe87b-9bc6-4651-bf2c-80f8376817d1",
    "event_at": "2026-06-04T18:23:11.482Z",
    "project_id": "a6478cdd-62d2-4e6c-2222-8c11e8663777",
    "configuration_rule_set_version_id": "019cc576-c1d5-7828-939a-07601c7c43f4",
    "schema_name": "com.hiddenlayer.runtime_security.runtime_policy_outcome_v1",
    "tags": {}
  },
  "policy_id": "b0596848-b7a6-4453-ad23-2b3136b1d8ff",
  "session_id": "7af8d1a8-742b-4400-b152-5ee702885b2f",
  "interaction_id": "b53bc9c8-e5cc-4bd8-a3bf-98576de4cb71",
  "external_session_ids": [
    { "id": "sess-abc-123", "source": "my-app" }
  ],
  "requester_id": "gpburdell",
  "evaluation": {
    "action": "BLOCK",
    "highest_threat_level": "HIGH"
  },
  "detections": [
    { "name": "prompt_injection" }
  ]
}

Audit Logs

{
  "action": "login",
  "actor_type": "USER",
  "api_permissions_required": [],
  "correlation_id": "1833e46c-2043-4142-8976-7f859a728e51",
  "description": null,
  "metadata": null,
  "occurred_at": "2025-12-16T20:17:16.169Z",
  "resource_id": "a6478cdd-62d2-4e6c-2222-8c11e8663777",
  "resource_type": "user",
  "session_id": null
}

​Requirements

​Configure Webhook

​Disable Webhook

​Delete Webhook

​Data Formats

​Runtime Security Convictions

​Supply Chain Scans

​Runtime Policy Outcomes

​Audit Logs