# Webhooks

Version: `2.9.8`

## Purpose

IAM sends webhooks to notify the SaaS about revocations, suspensions, and user updates.

## Verification

- SaaS keeps `IAM_WEBHOOK_SECRET` in its backend env
- IAM signs the payload with the same secret on the application record
- SaaS verifies `X-IAM-Signature`
- SaaS deduplicates `X-IAM-Webhook-Id`

## Payload example

```http
X-IAM-Signature: sha256=...
X-IAM-Webhook-Id: wh_123
```

```json
{
  "type": "session",
  "event": "revoked",
  "timestamp": "2026-05-15T17:00:00Z",
  "data": {
    "reference": "USR-XXXX",
    "alias_reference": "ALI000012025",
    "iam_token": "aat_xxx"
  }
}
```

## Rule

- do not revoke globally by default
- target the session with `iam_token`
- do not expose the numeric `app_access_tokens.id` as a public webhook field