Webhooks

Overview

AEGIX delivers signed webhook events to your endpoint.

Event envelope

Every delivery is a JSON object with a stable shape:

{
  "id": "uuid-of-this-delivery",
  "type": "monitor.threat.created",
  "createdAt": "2026-09-02T12:00:00.000Z",
  "data": { }
}

Event types

monitor.threat.created — monitored-wallet threat event
correlation.appeared — a new observable correlation crossed your threshold
correlation.increased — a persisted correlation increased meaningfully
correlation.decreased — a persisted correlation left the strong band
correlation.disappeared — a persisted correlation is no longer present

Delivery headers

aegix-webhook-id: <your webhook AEGIX id>
aegix-event-id: evt_01...
aegix-timestamp: 1720000000
aegix-signature: <hex HMAC-SHA256>

Signature scheme

Verify the signature against the exact raw body bytes:

signature = hex( HMAC-SHA256( secret, "<aegix-timestamp>.<rawBody>" ) )

Always use the raw request body exactly as received — never re-serialize it. See the signature and verification pages for the reference implementation.