Integrations.

The signature is how the proof survives.

Whether the connector is native or a raw webhook, every event is HMAC-signed. Downstream tools verify what fired, what changed, who reviewed it, and under what rights — so the consent chain holds once the event leaves us.

Grouped around the real work.

The catalog is easier to scan when it matches how teams work — releases, data, incidents, collaboration, observability.

Inspect the quickstart.

await client.integrations.github.dispatchWorkflow({ owner: 'aura', repo: 'evals', workflowId: 'ci.yml', ref: 'main' });

Verify the signature. Route the event.

One handler. Every payload is HMAC-signed, so you can prove it came from us, untampered, with the consent and provenance chain intact. Same response shape as the SDK. Archive, alert, or route from a single endpoint.

import { createHmac } from "crypto";

app.post("/webhooks/auraone", (req, res) => {
  const signature = req.headers["x-auraone-signature"];
  const expected = createHmac("sha256", process.env.AURAONE_WEBHOOK_SECRET!)
    .update(JSON.stringify(req.body))
    .digest("hex");

  if (signature !== expected) return res.status(401).end();

  if (req.body.event === "run.completed") {
    archiveToS3(req.body.data.evidenceUrl);
    postToSlack(req.body.data.summary);
  }

  res.status(200).json({ received: true });
});