Webhooks
Consent project webhooks and Rights delete webhook Systems.
Webhooks
Erasure has two different outbound webhook ideas. Do not mix them up.
| Kind | Product | Purpose |
|---|---|---|
| Project consent webhook | Accord | Notify your backend when consent updates |
| Webhook System | Rights | Signed delete notifications during fulfillment jobs |
1. Project consent webhook (Accord)
Optional project setting: notify your backend when consent updates after a receipt is stored (async; does not block the SDK).
| Topic | Documented behaviour |
|---|---|
| Event | consent.updated |
| Signature header | X-Accord-Signature: HMAC-SHA256 of the raw body |
| Secret | Signing secret encrypted at rest (same class as connector secrets) |
| Delivery | HMAC signature; SSRF checks; no unsafe redirects |
| Console | Project settings; webhook get/put; regenerate secret (Owner); test when supported |
| Integration | Verify on the server (Express/Fastify examples in console Develop where present) |
Config surface: project webhook get/put, regenerate secret (Owner), test, under project-scoped Accord routes.
TODO: Publish full JSON payload schema field-by-field when product freezes a public schema. Until then, verify signature on the raw body and treat unknown fields as additive.
Implementer checklist (consent)
- Endpoint HTTPS in production
- Verify
X-Accord-Signatureon raw body - Idempotent handling (retries may exist)
- Never log raw signing secrets
2. Rights Webhook System
A System connector type that receives signed delete notifications when Rights jobs run.
| Topic | Documented behaviour |
|---|---|
| Where | Rights → Systems → Webhook |
| Config | Endpoint URL |
| Auth | Signing secret (encrypted at rest) |
| Execution | POST signed payload; no redirect following |
| Limits | Treat as notification, not sole delete path |
| Rotate | Owner rotate; secrets may reveal once |
Guide: Connect a Webhook.
Prefer a real delete capability (SQL/HTTP) when you need guaranteed erasure; use webhook Systems to notify systems Erasure cannot reach inbound.
Security checklist
- Secrets never committed
- Signature verified (consent:
X-Accord-Signature, HMAC-SHA256 raw body) - Endpoint not open redirector
- Idempotent handling on your side
- SSRF-safe endpoints