Fired when a confirmation is denied — by an approver, or by the system (response.channel system) on a timeout (response.text timeout), a key rotation or an archived config.

postWebhookconfirmation.denied

Payload

event'confirmation.approved' | 'confirmation.denied' required

The event type — the same value as the X-Proof-Event header

confirmation_idstring required

MongoDB ObjectId

hitl_idstring required

HITL configuration the confirmation was sent through

status'approved' | 'denied' required
messagestring required

The stored ciphertext envelope, echoed back verbatim. The server never sees the plaintext, so this is never the human sentence — the approver decrypts it in their browser.

proof_tokenstring

Signed proof of the approver's decision; absent for a system denial (response.channel system)

encryptedboolean required

Whether message is a ciphertext envelope — derived from the message, not asserted

resolved_atstring date-time

Example payload

{
  "confirmation_id": "507f1f77bcf86cd799439011",
  "hitl_id": "507f1f77bcf86cd799439011",
  "message": "{\"v\":1,\"alg\":\"RSA-OAEP-256+AES-256-GCM\",\"ek\":\"...\",\"iv\":\"...\",\"ct\":\"...\",\"tag\":\"...\",\"kid\":\"...\"}",
  "response": {
    "action": "approve",
    "channel": "telegram"
  }
}

Response

Webhook received

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.