# Webhook Integrations

A webhook allows communication between applications by allowing a server to push data to a client when events occur. Using a webhook integration allows HiddenLayer to send new detection data to your application.

A detection is a grouping of convictions. A conviction is when HiddenLayer has determined that a malicious event, or set of malicious events, has taken place.

## Requirements

To enable a webhook integration, you need:

- Administrator access to the HiddenLayer Console (or have an administrator configure it for you).
- A URL for your webhook.


## Configure Webhook

The configuration settings allow you to submit models to the HiddenLayer SaaS AI Supply Chain Security service. Scan results are posted in the HiddenLayer Console.

1. In the HiddenLayer Console, go to **Admin > Integrations**.
2. For Webhook, click the menu (three vertical dots).

3. Select **Configure Integration**.
4. Enter a unique name for the webhook.

5. Enter the webhook URL.
6. Select the Webhook Method (POST or PUT).
7. To disable TLS verification, select the **Disable TLS Verification** checkbox.
8. To add a custom header.
  - Click **+ Add Header**.
  - Enter the header and the value.
  - If this header is a secret, select the **Is Secret** checkbox.
  - Custom headers supports Auth headers.

9. Click **Submit** to save the webhook integration.


## Disable Webhook

You can disable a webhook to stop the integration while retaining the webhook configuration for later use.

1. In the Console, on the **Admin > Integrations** page, edit the webhook.
  - Click the menu for the webhook (three vertical dots), then select **Configure Integration**.
2. Deselect the **Enabled** checkbox.

3. Click **Submit**.


## Delete Webhook

You can delete a webhook when it is no longer needed.

1. In the Console, on the **Admin > Integrations** page, delete the webhook.
  - Click the menu for the webhook (three vertical dots), then select **Delete**.

  - A message displays, asking you to confirm deleting the webhook.

2. Click **Delete**.


## Data Formats

Three different data sources can be exported via a single webhook configurations. A minimum of one data source must be enabled. The following provides an example of what will be exported for each data source.

### Runtime Security Convictions

```json
{
    "attributable_event_id": "0c7fe87b-9bc6-4651-bf2c-80f8376817d1",
    "concluding_event_id": "0c7fe87b-9bc6-4651-bf2c-80f8376817d1",
    "conviction_id": "b53bc9c8-e5cc-4bd8-a3bf-98576de4cb71",
    "conviction_timestamp": 1765915610241793453,
    "detection_category": "Guardrail Activation",
    "engine_name": "llmproxy",
    "mitre": {
      "Tactic": {
        "Name": "Impact",
        "SrcUrl": "https://atlas.mitre.org/tactics/AML.TA0011",
        "UID": "AML.TA0011"
      },
      "Technique": {
        "Name": "External Harms",
        "SrcUrl": "https://atlas.mitre.org/techniques/AML.T0048",
        "UID": "AML.T0048"
      }
    },
    "requester_id": "gpburdell",
    "sensor_id": "7af8d1a8-742b-4400-b152-5ee702885b2f",
    "severity": "Low",
    "source": "aidr",
    "tactic": "AML.TA0011",
    "technique": "AML.T0048",
    "tenant_id": "b2774567-7610-437a-1111-da6ec36cc347"
}
```

### Supply Chain Scans

```json
{
  "scan_result_summary": {
    "detection_categories": [
      "Graph Payload"
    ],
    "detection_count": 3,
    "end_time": "2025-12-16T20:01:16.010934055Z",
    "file_count": 3,
    "files_with_detections_count": 3,
    "has_genealogy": false,
    "inventory": {
      "model_id": "00000000-0000-0000-0000-000000000000",
      "model_name": "multiple onnx",
      "model_source": null,
      "model_version": "1",
      "model_version_id": "00000000-0000-0000-0000-000000000000",
      "origin": "Local File System",
      "request_source": "UI Upload",
      "requesting_entity": "gpburdell@hiddenlayer.com"
    },
    "scan_error": null,
    "scan_id": "3246d37b-b211-4983-80a8-86851c484fa8",
    "severity": "high",
    "signing": null,
    "start_time": "2025-12-16T20:01:10.916810185Z",
    "status": "done",
    "summary": {
      "detection_count": 3,
      "file_count": 3,
      "severity": "high",
      "files_with_detections_count": 3,
      "detection_categories": [
        "Graph Payload"
      ],
      "files_failed_to_scan": 0,
      "unknown_files": 0
    },
    "version": "25.12.1"
  }
}
```

### Audit Logs

```json
{
  "action": "login",
  "actor_type": "USER",
  "api_permissions_required": [],
  "correlation_id": "1833e46c-2043-4142-8976-7f859a728e51",
  "description": null,
  "metadata": null,
  "occurred_at": "2025-12-16T20:17:16.169Z",
  "resource_id": "a6478cdd-62d2-4e6c-2222-8c11e8663777",
  "resource_type": "user",
  "session_id": null
}
```