Contraforce Webhooks

generated: '2026-10-10'
method: searched
generator: extract-docs-artifacts.py (local)
source: https://docs.contraforce.com/guides/technical/configure-webhooks.md
sources:
- https://docs.contraforce.com/guides/technical/configure-webhooks.md
- https://docs.contraforce.com/guides/agent-center/agent-investigation-webhook.md
- https://docs.contraforce.com/api-reference/webhook-events.md
- https://docs.contraforce.com/api-reference/webhooks/list-webhooks.md
description: ContraForce webhooks deliver signed HTTPS POST requests for the listed event types. Each delivery includes an HMAC‑SHA256 signature
  in the `X-CF-Signature` header and, if configured, an `Authorization` header (None, Basic, or Bearer). Deliveries are retried with at‑least‑once
  semantics using the same `X-CF-Event-Id`.
events:
- event: webhook.test.v1
  description: A synthetic connectivity check sent only by the **Send test** action on a single webhook.
- event: incident.created.v1
  description: A new incident is ingested into a monitored workspace.
- event: incident.closed.v1
  description: An incident reaches Closed, including closures performed in the vendor's own portal.
- event: incident.status.changed.v1
  description: An incident moves to any status, including pauses, reopens and closes.
- event: incident.assignee.changed.v1
  description: An incident is assigned, reassigned or unassigned.
- event: incident.comment.added.v1
  description: An analyst, the AI agent, or a Gamebook adds a comment to an incident.
- event: gamebook.run.v1
  description: A Gamebook is dispatched against an incident.
- event: agent.investigation.completed.v1
  description: A Security Delivery Agent finishes an investigation and reaches a verdict whose classification card points at a webhook.
delivery:
  signature: HMAC‑SHA256 over X-CF-Timestamp + "." + raw_body, Base64‑encoded, placed in X-CF-Signature header
  content_type: application/json; charset=utf-8
note: Every delivery also includes X-CF-Schema, X-CF-Event-Id, X-CF-Timestamp, X-CF-Test (for test deliveries), and optional Authorization header
  (Bearer <token> or Basic <base64>) depending on the chosen authentication type.
docs: https://docs.contraforce.com/guides/technical/configure-webhooks.md