> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Notification Webhook

> Send signed Forge notifications to your security workflow.

Forge can send the same organization notification events used by Slack and
email to one HTTPS endpoint. This is useful for SOAR workflows, ticketing
systems, and custom security automation.

The event toggles and minimum severity under **Settings → Ownership** apply to
the webhook. Owner-specific delivery preferences remain Slack and email only.

## Set up

1. Open **Settings → Ownership**.
2. In **Webhook**, select **Connect webhook**.
3. Enter a public HTTPS endpoint and save it.
4. Copy the generated signing secret. Forge shows it only once.
5. Select **Send test** and return a `2xx` response within five seconds.
6. After the test succeeds, select **Enable**.

After setup, the Ownership page shows the webhook as **Connected**. Select
**Manage** to edit the endpoint, send another test, enable or disable delivery,
or regenerate the signing secret.

Changing the endpoint or regenerating the secret disables delivery until the
new configuration passes a test.

## Request

Forge sends one notification per request:

```json theme={"system"}
{
  "schema": "forge.notification.v1",
  "id": "anot_123",
  "type": "governance.request_created",
  "organizationId": "org_123",
  "occurredAt": "2026-08-02T18:00:00Z",
  "severity": "high",
  "title": "AI access request",
  "summary": "A governance request needs review.",
  "subject": { "type": "governance_request", "id": "greq_123" },
  "owner": { "targetType": "ai_product", "targetId": "chatgpt" },
  "forgeUrl": "https://app.forge.example/requests/greq_123"
}
```

`owner` is included only when the notification has an ownership target. Forge
does not include prompts, tool inputs, tool outputs, raw provider events, or
arbitrary internal metadata in this payload.

## Verify signatures

Requests include:

| Header                      | Value                                        |
| --------------------------- | -------------------------------------------- |
| `Idempotency-Key`           | Stable notification event ID                 |
| `X-Forge-Webhook-ID`        | Stable notification event ID                 |
| `X-Forge-Webhook-Timestamp` | Unix timestamp in seconds                    |
| `X-Forge-Webhook-Signature` | `v1=` plus an HMAC-SHA256 hexadecimal digest |

Compute HMAC-SHA256 over `<timestamp>.<raw request body>` using the signing
secret, then compare it to `X-Forge-Webhook-Signature` with a constant-time
comparison. Reject stale timestamps and process repeated webhook IDs
idempotently.

Forge does not follow redirects. Network errors, timeouts, `408`, `429`, and
`5xx` responses are retried up to three attempts. Any `2xx` response succeeds;
other responses fail permanently.

## Tines

Use a Tines Webhook action as the Forge destination. In the receiving Story:

1. Use `id` as the deduplication key.
2. Branch on `type` and `severity`.
3. Use `subject.type` and `subject.id` for enrichment or ticket correlation.
4. Include `forgeUrl` in analyst notifications and cases.

The webhook delivery history in Forge shows attempts and safe error details.
Replay a failed delivery from **Settings → Ownership** after correcting the
Story or receiver.

## Google Security Operations SOAR

Google SecOps SOAR accepts arbitrary JSON through an incoming webhook and maps
it to alert fields. Upload the Forge payload above as the JSON sample, then use
these minimum mappings:

| Google SecOps field | Forge value         |
| ------------------- | ------------------- |
| `TicketId`          | `id`                |
| `DisplayId`         | `id`                |
| `SourceSystemName`  | Constant `Forge`    |
| `Name`              | `title`             |
| `DeviceVendor`      | Constant `Forge`    |
| `RuleGenerator`     | `type`              |
| `StartTime`         | `occurredAt`        |
| `Description`       | `summary`           |
| `Priority`          | Map from `severity` |

Keep `DisplayId` unique so Google SecOps can deduplicate alerts. Test and
enable the mapping in **SOAR Settings → Ingestion → Webhooks**. Google
recommends a webhook for basic mapping and a connector only when advanced,
source-specific mapping is required. See [Set up a SOAR webhook](https://docs.cloud.google.com/chronicle/docs/soar/ingest/webhooks/setting-up-a-webhook).

This notification webhook creates workflow alerts and cases. For continuous,
searchable security telemetry, use [Security Exports](/integrations/security-exports)
instead.

## Other HTTPS receivers

Any receiver that accepts HTTPS JSON can use this integration. Preserve `id`
for idempotency, verify the signature before processing, return `2xx` only
after accepting the event, and use `forgeUrl` to send analysts back to the
source record.