Webhook Events Reference

Event structure

All webhook events share the same envelope:

{
  "event_id": "wevt_01HXYZ",
  "event_type": "inference.flagged",
  "org_id": "org_xxxx",
  "timestamp": "2026-04-12T14:23:01.432Z",
  "api_version": "2026-04-01",
  "data": {
    // event-specific payload
  }
}

Inference events

inference.pass

Fired when an inference is scored and passes all thresholds.

{
  "event_type": "inference.pass",
  "data": {
    "assessment_id": "asmt_01HXYZ",
    "probe_id": "probe-production-1",
    "model": "claude-sonnet-4-20250514",
    "scores": {
      "security": 0.02,
      "bias": 0.01,
      "accuracy": 0.91,
      "drift": 0.03,
      "cost": 0.08
    },
    "latency_ms": 2134,
    "input_tokens": 847,
    "output_tokens": 312
  }
}

inference.flagged

Fired when an inference exceeds a threshold in flag or block mode.

{
  "event_type": "inference.flagged",
  "data": {
    "assessment_id": "asmt_01HXYZ",
    "probe_id": "probe-production-1",
    "model": "claude-sonnet-4-20250514",
    "action": "flag",
    "violations": [
      {
        "scorer": "security",
        "score": 0.84,
        "threshold": 0.70,
        "reason": "potential_pii_exposure",
        "details": "High-confidence email address detected in response"
      }
    ],
    "scores": { "security": 0.84, "bias": 0.01, "accuracy": 0.89 }
  }
}

inference.blocked

Fired when an inference is blocked (block mode only).

{
  "event_type": "inference.blocked",
  "data": {
    "assessment_id": "asmt_01HXYZ",
    "model": "claude-sonnet-4-20250514",
    "action": "block",
    "violations": [
      {
        "scorer": "security",
        "score": 0.93,
        "threshold": 0.70,
        "reason": "credential_exposure"
      }
    ]
  }
}

Drift events

drift.baseline_established

Fired when a probe has collected enough inferences to establish a behavioral baseline.

{
  "event_type": "drift.baseline_established",
  "data": {
    "probe_id": "probe-production-1",
    "baseline_inferences": 100,
    "baseline_window_hours": 168
  }
}

drift.threshold_exceeded

{
  "event_type": "drift.threshold_exceeded",
  "data": {
    "probe_id": "probe-production-1",
    "drift_score": 0.31,
    "threshold": 0.25,
    "dimensions": {
      "topic": 0.28,
      "tone": 0.12,
      "length": 0.05
    }
  }
}

drift.sustained

Fired when drift persists for the configured number of consecutive batches.

drift.recovered

Fired when drift returns below threshold.

Policy events

policy.updated

Fired when your organization’s governance policy is changed.

{
  "event_type": "policy.updated",
  "data": {
    "changed_by": "ben@archetypal.ai",
    "old_version": "v3",
    "new_version": "v4",
    "changes": [
      { "field": "scoring.security.threshold", "from": 0.70, "to": 0.65 },
      { "field": "scoring.mode", "from": "flag", "to": "block" }
    ]
  }
}

Budget events

cost.budget_alert

Fired when hourly spend reaches the alert threshold.

{
  "event_type": "cost.budget_alert",
  "data": {
    "probe_id": "probe-production-1",
    "budget_utilization": 0.82,
    "tokens_used_this_hour": 820000,
    "tokens_budget": 1000000,
    "spend_usd": 12.30,
    "spend_budget_usd": 15.00
  }
}

Subscribing to specific events

When creating a webhook, specify only the events you need:

# Flag and block only
"events": ["inference.flagged", "inference.blocked"]

# All drift events
"events": ["drift.*"]

# Everything
"events": ["*"]

Wildcard patterns (*, inference.*, drift.*) are supported.