Run completion delivery

Delivered to each subscribed endpoint. x-index365-signature is t=<unix>,v1=<hmac-sha256 of '<t>.<body>'>; verify v1 against the raw body, reject timestamps older than five minutes, then use id or x-index365-event-id for idempotency.

postWebhookrun.completed

Headers

x-index365-event'run.completed' | 'run.failed' required

x-index365-event-idstring required

x-index365-signaturestring required

Payload

idstring required

type'run.completed' | 'run.failed' required

createdAtstring date-time required

Example payload

{
  "id": "evt_2b0d6297b1494d6d8d60d94b3d41bb5c",
  "type": "run.completed",
  "createdAt": "2026-08-13T19:58:00.000Z",
  "data": {
    "runId": "b59e4634-0d9e-4a0f-a9b0-3f2a34f21c8d",
    "projectId": "a3a6036a-9ba6-47dc-8f22-085454121895",
    "status": "completed",
    "url": "https://acme.test/",
    "score": null,
    "scoreStatus": "unverified",
    "severityCounts": {
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0,
      "info": 3
    },
    "findingsTotal": 0,
    "error": null,
    "humanUrl": "https://index365.co/dashboard/project/a3a6036a-9ba6-47dc-8f22-085454121895/audits/ai-readiness",
    "apiUrl": "https://index365.co/api/v1/runs/b59e4634-0d9e-4a0f-a9b0-3f2a34f21c8d"
  }
}

Response

Receiver acknowledged the delivery.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.