Webhooks

Register HTTPS endpoints to receive events when cases progress, permits or certificates are granted, or Global monitoring detects elevated risk for people abroad.

Setup

1. In Admin → Developers, create a webhook with a public https:// URL and the events you need.
2. Store the webhook signing secret (shown once).
3. Verify each delivery using the X-Dimmi-Signature header.

Webhook URLs must be public HTTPS (no private/literal IPs) — Dimmi rejects unsafe URLs.

Envelope

{
  "id": "<event-uuid>",
  "type": "permit.granted",
  "created_at": "2026-08-02T12:00:00Z",
  "data": { }
}

Events

Event	When
case.created	A case is created
case.status_changed	Case status changes
case.document_uploaded	A document is attached
case.linked	A linked/settling child case is attached to a parent
permit.granted	Immigration case reaches permit acquired
permit.expiring	Permit enters expires-soon
permit.expired	Permit expired
certificate.granted	A1/S1 (or similar) certificate issued
assignment.created	Cross-border assignment journey created
monitoring.employee_at_risk	Advisory/crisis exposure for a person
monitoring.crisis_alert	Organisation-level crisis/advisory alert

For full-service cases, Dimmi may deliver to webhooks on both the client organisation and the handling organisation when both have subscriptions.

Signature verification

Header format (Stripe-style):

X-Dimmi-Signature: t=<unix_ts>,v1=<hmac_sha256_hex>

Compute HMAC-SHA256 of {t}.{raw_body} with your webhook secret and compare to v1 using a constant-time compare. Reject stale timestamps.