Integrations

Webhooks

Push Mnemos events to your services with signed payloads and reliable delivery.

Event catalog

Event	Note
session.created	A new interview session was created.
session.completed	A session ended; transcript and extractions are ready.
session.failed	Capture failed; the session is in error state.
sop.draft.created	Extraction produced a new draft SOP.
sop.approved	An SOP moved to approved.
sop.archived	An SOP was archived.
sop.stale	An approved SOP dropped below freshness threshold.
entity.created	A new graph entity was added.
entity.updated	A graph entity was edited.
entity.merged	Two entities were merged into one.
member.invited	A member invite was sent.
member.joined	A member completed sign-in for the first time.
member.role_changed	A member's role was updated.
risk.elevated	Continuity risk for an entity crossed a threshold.
audit.export.completed	A requested audit export finished.
integration.connected	An integration completed OAuth.
integration.disconnected	An integration was removed.

Payload format

All webhook payloads share an envelope. Resource-specific fields live under data.

envelope

{
  "id": "evt_01HZX5...",
  "type": "sop.approved",
  "created_at": "2026-05-18T14:22:01.482Z",
  "api_version": "2026-04-01",
  "tenant_id": "org_01H...",
  "data": {
    "sop_id": "sop_01H...",
    "version": 4,
    "approver_id": "usr_01H..."
  }
}

Signature verification

Every request includes X-Mnemos-Signature (HMAC-SHA256 over timestamp.body) and X-Mnemos-Timestamp. Compute the HMAC with your endpoint's signing secret and reject deliveries older than 5 minutes to prevent replay.

node verification

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(body, signature, timestamp, secret) {
  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${body}`)
    .digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && timingSafeEqual(a, b);
}

Delivery and retries

Mnemos retries failed deliveries with exponential backoff at 30s, 2m, 10m, 30m, 1h, 6h, 12h, and 24h. After 24 hours the delivery is marked failed. Endpoints that return 410 Gone or are repeatedly failing for 7 days are disabled with an Owner notification.

Idempotency

Each delivery includes a stable event.id. Persist it on receive and de-duplicate; retries may arrive after a successful first delivery if Mnemos didn't see a 2xx response in time.