Event signature

Each webhook attempt carries a signature over the event payload. Verify the signature before processing the body. Do not rely on IP filtering alone.

Subscription management

Subscriptions bind to registered pv_webhook_endpoints rows — no raw delivery secrets are accepted directly. Create subscriptions via the MCP create_subscription tool (all event types) or subscribe_trust_changes tool (TRUST_STATE_CHANGED / TRUST_STATE_INVALIDATED). Required: tenant_id, organization, subscriber_principal, event_scope, endpoint_id, idempotency_key, created_by.

Event scope

Trust-state events: TRUST_STATE_CHANGED (new evidence, new determination, policy change), TRUST_STATE_INVALIDATED (evidence invalidated, authority change, continuity conflict). Subscriptions can target a specific subject_public_id or ALL subjects.

Idempotent consumers

Use event ID and sequence to prevent duplicate side effects. Preserve the original event timestamp and lifecycle context. authority_state in event payloads will reflect NOT_AUTHORIZED until Phoenix activates production authority.