Overview
When Corvid delivers a webhook, it sends an HTTP POST request with a JSON payload to your configured endpoint. This article describes the payload structure and the event types you can subscribe to.
Payload Structure
Every webhook payload follows this structure:
{
"event": "alarm.created",
"timestamp": "2026-01-15T14:32:00Z",
"organization_id": "org_abc123",
"data": {
// Event-specific fields
}
}event — The event type that triggered the webhook (see below).
timestamp — ISO 8601 timestamp of when the event occurred.
organization_id — The ID of the organization the event belongs to.
data — The event payload. Contents vary by event type.
Event Types
alarm.created — A new alarm was triggered. Payload includes alarm ID, type, site, camera, and associated plate (if applicable).
alarm.updated — An alarm status changed (acknowledged or resolved). Payload includes the updated alarm state.
hotlist.match — A plate matched a hotlist entry. Payload includes plate number, hotlist ID, camera, site, and confidence score.
camera.offline — A camera lost connection. Payload includes camera ID, site, and timestamp.
camera.online — A camera restored connection. Payload includes camera ID and site.
case.created — A new case was created.
case.updated — A case status or content changed.
Verifying Payloads
If you configured a secret key when creating the webhook, Corvid signs each request with an HMAC-SHA256 signature. The signature is included in the X-Corvid-Signature header. Verify it on your server to ensure the payload is genuine.
Notes
Payload schemas may evolve over time. Write your integration to handle unknown fields gracefully.
For the most current payload specs, contact Corvid support or your integration engineer.