Audit event recorded

Body of every webhook delivery: {id, type, created_at, data}, signed as described in this reference (NR-Webhook-Signature over 'timestamp.payload'). Ten event types. assessment.updated fires when an assessment's score, band, recommendation, coverage or status changes while it is served; updates that change none of these are coalesced, and the final one has status complete. assessment.updated reports progress only and is not actionable: act on account.risk_changed. An expiry is terminal and carries only minimal data: status 'expired', change_reason 'expired', the last served assessment_version and no assessment (GET now answers 404); the consumer deletes what it holds for the assessment. account.deleted fires once when DELETE /v1/accounts/{account_id} erased at least one assessment of the account: its data names the account_id, how many assessments went and when; the consumer deletes what it holds from the account's assessments created at or before data.deleted_at, ignores a later-arriving update of such an assessment, and keeps any assessment created after it (the account assessed again), even when the event arrives last. A repeat erasure that deleted nothing sends no event. workspace.deleted is the last event an environment's endpoints receive: it fires once per environment when its workspace is deleted (DELETE /v1/workspaces/{workspace_id}), after the deletion took effect (every key answers 401, every assessment and account is gone) and before the endpoints themselves are removed; the consumer deletes what it holds for that environment and stops calling the API with its keys. webhook_endpoint.disabled fires when one of the environment's endpoints was disabled after failing continuously for 72 hours: it goes to the environment's other verified endpoints (the disabled endpoint receives nothing until it is verified again), and is not sent when there are none. account.risk_changed is the one actionable event. It fires once when the decision of an account for at least one flow changes, and for the account's first decision that is not allow; a first decision of allow sends nothing, and so does a score that moves without changing any flow's decision. Its data is the account as GET /v1/accounts/{account_id} answers it for the change (the new score, decisions and reasons, at the risk_version that change made) and the decisions per flow it replaced (allow for every flow before the account's first decision). A held flow (settings admission held) announces held when its assessment is answered, then exactly one change away from held: the decision of the completed investigation, or the flow's on-expiry decision when the hold's deadline passed first, so an expired hold is always announced. The event only wakes the receiver: decide from the account at its newest risk_version, or from GET /v1/accounts/{account_id}. screening.completed, person.flagged and person.decided are screening's: screening.completed fires once when a screening of a group finishes completed, partial or failed, with its counts by band, how many had no footprint and how many it did not fully cover; person.flagged fires for each person a screening flags, with its highest band and not what was posted; person.decided fires for each decision a reviewer records (cleared, watch or escalated). They name groups, people and screenings by id only: read the person or its report for anything more. endpoint.verification carries a challenge the endpoint must echo to prove it is the intended receiver. Deliveries are at-least-once and unordered: deduplicate on id, drop an assessment whose detail.assessment_version is not newer than the one held, and drop an account whose risk_version is not newer than the one held. Polling GET /v1/assessments/{assessment_id} stays authoritative. An event sent by POST /v1/webhooks/{endpoint_id}/test carries test: true and a fixed example assessment. audit.event carries the immutable public audit event only to an explicit audit-stream subscription. Its id is stable across retries and endpoint fan-out. An endpoint must be verified; environment and action filters apply before queueing and are rechecked before each delivery. Workspace-scoped events require an unrestricted member to configure. Streams start at subscription time; audit exports provide available historical events. Delivered data is controlled by the receiver and is not remotely erased by changing NoResponse retention.