Skip to main content

Overview

Webhooks let you receive real-time HTTP notifications when events occur in your Bluejay simulations, observability logs, and alerts. Instead of polling, Bluejay sends a POST request to your endpoint whenever a subscribed event fires. See the Events Webhook reference for the full payload schema.

Security

Source

All webhook requests originate from api.getbluejay.ai. If your endpoint sits behind a firewall or IP allowlist, whitelist that hostname (or its resolved IPs) so our requests can reach you.

Request headers

Every webhook request includes the following headers:

Verifying requests

  1. Read the raw request body (do not re-serialize the JSON — signature verification is byte-sensitive).
  2. Compute HMAC-SHA256(body, signing_secret) using the signing secret shown in your webhook settings.
  3. Compare the hex digest against the X-Bluejay-Signature header using a constant-time comparison.
Reject any request whose signature does not match.

Recommendations

  • Always use an HTTPS endpoint.
  • Respond within 5 seconds; do heavier work asynchronously.
  • Treat deliveries as at-least-once and dedupe on X-Bluejay-Delivery.

Events

You can subscribe to these event types. Select a tab to see its payload.
Fires when a simulation result finishes evaluating.Event type: simulation_result_evaluated

Scoping webhooks to agents and folders

When you create a webhook, pick the agents or folders it should listen to. Only events from those agents — or from any agent in the selected folders — will trigger delivery.
  • Select agents to narrow down to specific agents.
  • Select folders to include every agent in that folder.
  • Combine both for granular rules.

Troubleshooting

Webhook not triggering
  • Confirm the webhook is enabled.
  • Confirm the source agent or folder is in the webhook’s scope.
  • Confirm the event type is included in the subscription.
  • Confirm the endpoint URL is reachable and responds within 5 seconds.