Receive signed webhook events when policies trigger, agents act, or customers change.
Webhooks let your platform react to MOSS events in real time. Get notified when a policy blocks an action, when a customer is promoted, or when an escalation is triggered. All webhooks are signed with ML-DSA-44.
const webhook = await fetch('https://api.mosscomputing.com/v1/webhooks', {
method: 'POST',
headers: {
'Authorization': 'Bearer ' + prt_token,
'Content-Type': 'application/json',
},
body: JSON.stringify({
url: 'https://your-platform.com/moss/webhook',
events: [
'policy.blocked',
'policy.escalated',
'customer.promoted',
'customer.suspended',
'agent.revoked',
],
}),
});Always verify the webhook signature before processing. MOSS signs every webhook with ML-DSA-44 post-quantum signatures.
import crypto from 'crypto';
function verifyWebhook(rawBody: string, signature: string, publicKey: string): boolean {
// Verify the ML-DSA-44 signature
// The signature is in the X-MOSS-Signature header
// The public key is available at:
// GET https://api.mosscomputing.com/.well-known/moss-keys.json
try {
const verifier = crypto.createVerify('sha256');
verifier.update(rawBody);
return verifier.verify(publicKey, signature, 'base64');
} catch {
return false;
}
}
// Express middleware example
app.post('/moss/webhook', (req, res) => {
const signature = req.headers['x-moss-signature'] as string;
const rawBody = JSON.stringify(req.body);
if (!verifyWebhook(rawBody, signature, MOSS_PUBLIC_KEY)) {
return res.status(401).json({ error: 'Invalid signature' });
}
// Process the verified event
const event = req.body;
switch (event.type) {
case 'policy.blocked':
console.log('Agent blocked:', event.data.agent_id);
break;
case 'customer.promoted':
console.log('Customer promoted:', event.data.customer_id);
break;
}
res.status(200).json({ received: true });
});Partner integration complete!