Roadmap · Webhooks

Pushed event delivery is on the roadmap.

Today you get the answer on the same request: your server calls rh.verify() and reads the result immediately. Webhooks — Root Herald pushing later changes to you (a device going stale, a session revoked) without you having to poll — are planned but not shipping yet. The shapes below are a design preview, not an available feature.

planned shape — a signed event Root Herald would push to youjson
{
  "iss":  "https://rootherald.io/acme",       // who sent it (your Root Herald account)
  "iat":  1718500000,                         // when it happened
  "jti":  "set_9f2c…",                        // unique ID for this event
  "events": {
    "https://rootherald.io/event/attestation-completed": {
      "subject": { "device_ueid": "2f9c8a14…" },   // anonymous ID for the device
      "earStatus": "affirming",                     // how strong the hardware proof was
      "acr": "urn:rootherald:device:high"           // assurance level
    }
  }
}

What you get instead today

You get the answer on the same request.

Every answer you need comes straight back from rh.verify(). There is no event stream to subscribe to and nothing to poll — the check happens on your request and the result returns immediately. When pushed delivery ships, it will sit alongside this path, not replace it.

Planned events

What the event catalog is expected to cover.

attestation-completed

A device check succeeded, or passed with a warning.

attestation-failed

A device check failed: the proof didn't check out, a rule rejected it, or the challenge expired.

compliance-change

A device's confidence level changed since you last saw it.

session-revoked

A session was revoked out of band.

enrollment-revoked

A device enrollment was revoked.

device-stale

A device hasn't checked in within your staleness window.

Build on the same-request answer today.

Free up to 10,000 device checks a month.

Start freeOpen the docs →