Integrations · Webhooks
Ansyra + Webhooks Live
When an audit completes, a brief is created, content clears approval, an asset publishes, or an alert fires, Ansyra can POST a signed event to your endpoint. This is also how Zapier, Make and n8n connect today.
Availability: Every plan; org owners and admins manage endpoints in Settings › Connections.
What you get
- Five events: scan.completed, brief.created, content.approved, content.published, alert.raised.
- Every delivery is HMAC-SHA-256 signed (X-Ansyra-Signature; legacy alias X-Stack-Signature) with your whsec_ secret.
- Five delivery attempts with exponential backoff, plus per-endpoint delivery history.
- Works with any HTTPS endpoint: your own service, Zapier, Make, n8n, Slack via a relay.
Set it up
- Open Settings › Connections › Outbound webhooks and add your endpoint URL.
- Choose the events you want; copy the signing secret (shown once).
- Verify the signature on receipt, reject deliveries more than 5 minutes old, and de-duplicate on x-ansyra-delivery before processing the JSON payload.
Verify a delivery
// Verify X-Ansyra-Signature (legacy alias: X-Stack-Signature, identical value)
// v1=HMAC_SHA256(secret, "<timestamp>.<raw body>"); use the RAW body, before JSON parsing
const ts = req.headers['x-ansyra-timestamp'];
// The signature itself never expires, so check freshness too or a captured delivery replays forever.
const fresh = Math.abs(Date.now() / 1000 - Number(ts)) <= 300;
const expected = 'v1=' + crypto.createHmac('sha256', WEBHOOK_SECRET)
.update(ts + '.' + rawBody).digest('hex');
const a = Buffer.from(req.headers['x-ansyra-signature'] ?? '');
const b = Buffer.from(expected);
// Length-check first: crypto.timingSafeEqual throws on a length mismatch instead of returning false.
const ok = fresh && a.length === b.length && crypto.timingSafeEqual(a, b);Put Webhooks to work on your AI visibility
Free for 14 days on ChatGPT, Gemini and Google's AI answers; all five AI engines on every plan.