iOS 16 and iOS 17 support ends late July 2026. Update your device to iOS 18.0 or later to continue receiving Cerby app updates.
Ctrlk
CerbyDeveloper PortalSupportWeMakeCerby
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Create a webhook

This article describes how to create a webhook endpoint in Cerby to receive real-time signed HTTPS notifications.

Who can use this feature?

  • Workspace Owners, Super Admins, and Admins

  • Supported using the Cerby web app

As a workspace Owner, Super Admin, or Admin, you can create webhook endpoints to receive real-time signed HTTPS notifications when account and automation events occur in your workspace. You can create multiple webhooks, each subscribed to a different set of event types.

Requirements

This procedure requires the following:

  • A Cerby workspace with the webhooks feature enabled

  • An HTTPS endpoint you control that can receive POST requests from Cerby

  • A user account with the workspace Owner, Super Admin, or Admin role

Steps

To create a webhook, complete the following steps:

  1. Log in to your Cerby workspace.

  2. Select Settings from the left navigation. The Workspace Configuration page is displayed.

  3. Select the Webhooks left tab.

  4. Click the Create webhook button. The Create new webhook page is displayed.

1. Webhook details

  1. Enter a name for the webhook in the Name field. The name must be between 1 and 100 characters.

  2. Enter your endpoint URL in the Endpoint URL field. The URL must start with https:// and cannot exceed 2,048 characters.

    NOTE: If your endpoint URL is a Slack Incoming Webhook (hooks.slack.com), Cerby delivers a Slack Block Kit message instead of the standard JSON envelope. Refer to the "Sending to a Slack Incoming Webhook" section of Implement a webhook receiver for details on the format and field subset.

  3. (Optional) Enter a description in the Description field. The description cannot exceed 512 characters.

  4. Click the Next button. The Select events section is displayed.

2. Select events

  1. Select the event types you want to subscribe to. You can select individual event types or choose a preset selection:

    • Select Audit-only to subscribe to every available event type except the actionable failure events, that is, the events a compliance team records but that don't need remediation.

    • Select Failures-only to subscribe to the actionable failure events: account.credentials.rotation_failed, account.login.failed, account.mfa.setup_failed, and automation.failed.

    • Select Everything to subscribe to all available event types.

    You must select at least one event type to proceed.

  2. Click the Next button. The Signing method section is displayed.

3. Signing method

  1. Select a signing algorithm:

    • Select Ed25519 (recommended) to use asymmetric signing. Cerby generates a key pair and returns your public key after the webhook is created. You store the public key and use it to verify signatures.

    • Select HMAC-SHA256 to use symmetric signing. Cerby generates a shared secret and returns it after the webhook is created. You store the shared secret and use it to verify signatures.

  2. Click the Create webhook button. The webhook is created and your signing key material is displayed.

4. Copy your signing key

IMPORTANT: Copy your signing key material before leaving this page. Cerby displays the key only once. If you leave without copying, you must rotate the signing key to obtain new key material.

  1. Copy the key material displayed:

    • Ed25519: Copy the Public key value and store it securely. You will use this key to verify the X-Cerby-Signature header on incoming webhook requests.

    • HMAC-SHA256: Copy the Signing secret value and store it securely. You will use this secret to verify the X-Cerby-Signature header on incoming webhook requests.

  2. Click the Done button. The new webhook appears in the Webhooks list.

Related articles

Feature guides:

Developer reference:

Last updated

Was this helpful?