Register a webhook

Subscribes one of your endpoints to a Saturn event.

event_name uses lower snake_case in resource.action format, for example fact_find.created.

Endpoint verification

Saturn immediately sends this signed request to your endpoint before storing the subscription:

POST <your endpoint>
Content-Type: application/json
X-Saturn-Signature: <hex HMAC-SHA256 of the body>
{"message": "Register Webhook", "event_name": "fact_find.created"}

Your endpoint must return 200 or 201 within 2 seconds. Any other status, a timeout, or an unreachable host returns 422 and stores nothing.

Signature verification

X-Saturn-Signature is the hex-encoded HMAC-SHA256 of the raw request body under your signing_secret. Recompute it over the bytes received and use a constant-time comparison. Saturn never sends or returns the secret, so keep your own copy.

Rules

• endpoint must be an HTTPS URL on a publicly reachable host.

• Registering the same event on different endpoints is allowed.

• Registering the same event on the same endpoint twice returns 409.

• Saturn identifies your firm from the API key.