safeguard webhooks create \
  --url https://example.com/sg \
  --events findings.vulnerability.created,findings.secret.verified \
  --secret $(openssl rand -hex 32) \
  --filter 'severity in ["critical","high"] and env == "production"'

{
  "id": "evt_01J...ABC",
  "type": "findings.vulnerability.created",
  "created_at": "2026-04-23T12:34:56.789Z",
  "data": { "finding": { ... }, "asset": { ... } },
  "tenant": "acme",
  "api_version": "2026-01-01"
}

const es = new EventSource("https://api.safeguard.sh/v1/events/stream", {
  headers: { Authorization: `Bearer ${token}` }
});
es.addEventListener("findings.vulnerability.created", (e) => { ... });

safeguard events list --after "2026-04-23T00:00:00Z" --type findings.*.created

severity in ["critical","high"]
AND env == "production"
AND NOT finding.kev == false

import hmac, hashlib, time

def verify(secret: bytes, header: str, body: bytes) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(",", 1)[1].split(","))
    ts, sig = parts["t"], parts["s"]
    # reject events older than 5 min (replay guard)
    if abs(time.time() - int(ts)) > 300: return False
    expected = hmac.new(secret, f"{ts}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig)

import { createHmac, timingSafeEqual } from "crypto";

export function verify(secret: string, header: string, body: Buffer): boolean {
  const [_, tsPart, sigPart] = header.split(",");
  const ts = tsPart.slice(2);
  const sig = sigPart.slice(2);
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${ts}.`).update(body).digest("hex");
  return timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
}

safeguard webhooks test --endpoint https://example.com/sg --type findings.vulnerability.created

safeguard webhooks list
safeguard webhooks create --url ... --events ...
safeguard webhooks update <id> --filter '...'
safeguard webhooks delete <id>
safeguard events list
safeguard events show <id>
safeguard events replay <id>   # replays to all subscribed endpoints