AbuseZero webhooks: every evaluation in your own systems
AbuseZero webhooks send every evaluation, outcome and list change to your own endpoints as it happens. Signed, retried, filtered and logged. Here's what you can build.
Your server already gets each evaluation's result in the response. But the rest of your company doesn't sit in that request: the alerting channel, the data warehouse, the review queue, the CRM. AbuseZero webhooks bring every evaluation, outcome change, list change and finished background job to those systems as it happens, as signed requests to your own HTTPS endpoints.
The difference matters most on a bad night. Without webhooks, a wave of repeat claims shows up in tomorrow's dashboard or next month's invoice. With them, it shows up in your alerting channel while it's still happening. One team in our early beta found out about an automated sign-up wave from the bill: $12,000 overnight, on a cloud account that normally cost $200 to $300 a month.
What you can build
- Real-time abuse alerts. An endpoint that receives only denied evaluations for your most expensive benefits. A sudden spike means a wave has started, or a promo code has leaked. See how to stop promo code and referral abuse.
- Analytics in your own warehouse. Every result and outcome in the place your team already queries.
- Background evaluations. Grant a trial instantly and apply the result when
evaluation.completedarrives. See zero-wait free trials. - Review and support workflows. Route denied claims to the team that handles appeals, with the evaluation's reason attached.
The events
| Event | Sent when |
|---|---|
evaluation.completed | An evaluation returns allow or deny, including on benefits in observe mode |
evaluation.skipped | An evaluation doesn't run, for example when the workspace is out of credits or the benefit is paused |
outcome.updated | An outcome changes state, a grant after a deny is recorded, or an outcome passes its due time |
access_list_entry.created and .deleted | An allow or block list entry is added or removed |
import.completed | An import finishes |
export.completed | An export is ready to download |
data_deletion.completed | A user's data deletion finishes |
webhook.test | You send a test event |
Each event's data is the same object the AbuseZero REST API returns, built from the same public fields. Evidence and the request details your server sent are never included. Every payload is in webhook events.
Built to be dependable
- Recorded with the change. An event is recorded together with the change it describes, so an evaluation that returns a result always sends its event, and a request that fails never does.
- Signed per endpoint. Every request is signed with that endpoint's own
whsk_secret, so you can prove it came from AbuseZero and wasn't changed. - Retried with identical bytes. A delivery without a
2xxreply is attempted up to 6 times over 12 hours, with the same event ID and body every time. - Filtered per endpoint. Choose the events, limit an endpoint to chosen benefits, or receive denied evaluations only.
- A complete delivery log. Every delivery keeps its exact body and each attempt's status, timing and reply for 30 days, and you can send any delivery again.
- Failing endpoints handled. An endpoint that fails every delivery for 3 days is paused, and the workspace owner and admins are emailed.
- Rotation without downtime. After you rotate a signing secret, the previous one keeps signing beside it for 24 hours.
- No credential can redirect your events. Only the workspace owner and admins add or change endpoints, in the dashboard. No API key, OAuth token or machine client can send your workspace's events somewhere new.
Know while it's happening
Webhooks come with every plan. Point denied evaluations at your alerting channel and see the next wave as it starts. Start with Builder or see pricing.
Receive and verify an event
The AbuseZero Node.js SDK verifies the signature for you. Read the raw body, verify it, reply quickly and do the work afterwards.
import { verifyWebhook, WebhookVerificationError } from "abusezero/server";
import { enqueue } from "@/lib/jobs";
export async function POST(request: Request) {
const payload = await request.text();
let event;
try {
event = verifyWebhook({ payload, headers: request.headers, secret: process.env.ABUSEZERO_WEBHOOK_SECRET! });
} catch (error) {
if (error instanceof WebhookVerificationError) return new Response(null, { status: 400 });
throw error;
}
await enqueue("abusezero-event", event); // Your own queue. Handle the event after replying.
return new Response(null, { status: 204 });
}Delivery is at least once and events can arrive out of order, so use the event id to skip duplicates and the object's own fields to decide what's current. The full guide is receive webhooks.
Set it up in a few minutes
Add an endpoint in Developers → Webhooks: an HTTPS URL, the events you want, and optionally the benefits it covers.
Store the signing secret shown once when the endpoint is added.
Send a test event from the dashboard, the API, the AbuseZero CLI or the AbuseZero MCP server.
Watch the delivery log to confirm every attempt and its reply.
Frequently asked questions
What are AbuseZero webhooks?
Signed HTTPS requests that AbuseZero sends to your endpoints when something happens in your workspace: an evaluation completes, an outcome changes, a list entry is added, or a background job such as an import finishes.
How do I get alerted when a wave of repeat claims starts?
Add an endpoint that receives denied evaluations only, limited to your most expensive benefits, and point it at your alerting channel. A spike in denials is your early warning.
What happens if my endpoint is down?
Each delivery is retried up to 6 times over 12 hours with the same body. After that, you can send failed deliveries again from the dashboard or the API.
Do webhooks include the evidence behind a decision?
No. Events carry the same public objects as the REST API. Evidence and the request details you sent are never included.
Do webhooks cost extra?
Every plan includes a monthly allowance of webhook deliveries. Current allowances and rates are on the pricing page.
Bring AbuseZero into your stack
Start with Builder
Pay as you go. Webhooks included.
Webhooks in the docs
Events, delivery and configuration.
See pricing
Builder, Pro, Scale and Enterprise.