Roadmap · Webhooks

Out-of-band event delivery is on the roadmap.

Today the verdict is synchronous: your backend calls rh.verify() and reads the result on the same request. Webhook delivery (pushing posture changes and revocations to you without polling) is planned but not shipping yet. The shapes below are a design preview, not an available feature.

planned shape — a signed Security Event Token (SET), RFC 8417json
{
  "iss":  "https://rootherald.io/acme",
  "iat":  1718500000,
  "jti":  "set_9f2c…",
  "events": {
    "https://rootherald.io/event/attestation-completed": {
      "subject": { "device_ueid": "2f9c8a14…" },
      "earStatus": "affirming",
      "acr": "urn:rootherald:device:high"
    }
  }
}

What we get instead today

The verdict is synchronous.

Every verdict you need is returned inline from rh.verify(). There is no event stream to subscribe to and nothing to poll — the appraisal happens on your request and the result comes straight back. When out-of-band delivery ships, it will sit alongside this path, not replace it.

Planned events

What the event catalog is expected to cover.

attestation-completed

An attestation succeeded, or passed with a warning.

attestation-failed

An attestation failed: quote failure, policy reject, or a stale challenge.

compliance-change

A device's assurance level changed since you last saw it.

session-revoked

A session was revoked out of band.

enrollment-revoked

A device enrollment was revoked.

device-stale

A device hasn't attested within your staleness window.

Build on the synchronous verdict today.

Free up to 10,000 attestations a month.

Start freeOpen the docs →