generated: '2026-07-18'
method: searched
spec_type: Webhooks
source: https://www.cakewalk.security/docs/open-api-and-mcp/webhooks
docs:
  webhooks: https://www.cakewalk.security/docs/open-api-and-mcp/webhooks
  signature_verification: https://www.cakewalk.security/docs/open-api-and-mcp/webhooks/webhooks-signature-verification
delivery:
  envelope: >-
    The request body is a JSON array. Each element is an object with eventType
    (discriminator) and data (event-specific payload); multiple events may be
    delivered in one request.
registration:
  fields: [target_url, events, secret]
  notes: A webhook is registered with a target URL, the events to subscribe to, and a secret.
signature:
  header: X-SIGNATURE
  algorithm: SHA256withRSA
  encoding: base64
  padding: PKCS1v15
  method: >-
    Cakewalk signs the SHA-256 hash of the raw request body with its RSA private
    key. Consumers fetch Cakewalk's public key from
    https://open-api.getcakewalk.io/api/Keys (with API credentials), base64-decode
    the X-SIGNATURE header, and verify the signature against the raw payload.
    Verification operates on the exact raw body with no normalization.
  public_key_endpoint: https://open-api.getcakewalk.io/api/Keys
events:
- type: test
  description: Validates that the webhook URL accepts events during the verification flow.
- type: action_task.actionable
  description: >-
    Triggered when an action step is ready for execution after review completion
    (an actionable task).