Alerts & webhooks

When an agent triggers a high or critical security event — an invalid signature, a blocked action, a sensitive-data attempt — your team hears about it without watching the dashboard.

Email alerts (built in)

High and critical security events automatically email your project's owners and admins with a digest of what happened and a link to the Security page. Alerts are throttled to at most one email per project per hour, so an incident produces a page, not a flood. No setup required.

Polling for events (custom integrations)

# Everything the alerts see is available over the API — poll for open
# high-severity events and route them to Slack/PagerDuty/your queue:
GET /api/security-events?resolved=false&limit=50

# Per-agent:
GET /api/agents/support-agent/security-events

# Mark handled:
PATCH /api/security-events/:id/resolve

Combine with GET /api/agents/:id/trust-history to alert on trust-score drops with their reasons.

Push webhooks

Note

Signed push webhooks (HMAC, per-event delivery for security_event, approval_requested, and trust_level_changed) are on the roadmap. Until then, the polling API above covers the same data — and the email alerts cover the urgent path.

Trust score →API reference →