Webhooks & Events

CRED communicates with providers and subscribers as changes occur. Register an endpoint, choose the events you care about, and receive signed JSON deliveries within seconds of any change.

Event catalog

equivalency.createdA new course equivalency was published to the repository.

equivalency.updatedAn existing equivalency changed (status, credit value, or policy basis). A new immutable version is recorded.

course.updatedA course record changed (title, credits, description, CIP code).

dataset.publishedA contributing organization published a new dataset version after validation.

Example delivery

Deliveries are HTTP POSTs with two headers: X-CRED-Event (the event type) and X-CRED-Signature (an HMAC-SHA256 signature).

json

{
  "id": "evt_8f3kz1",
  "type": "equivalency.created",
  "created": "2026-05-01T15:04:05Z",
  "data": {
    "equivalencyId": "eq_0042",
    "sourceCourse": {
      "institution": "Wake Technical Community College",
      "code": "ENG 111"
    },
    "target": {
      "institution": "UNC-Chapel Hill",
      "code": "ENGL 101"
    },
    "status": "accepted",
    "policyBasis": "NC Comprehensive Articulation Agreement"
  }
}

Verifying signatures

Each endpoint has a secret (shown once at registration). The signature is computed over {timestamp}.{raw body} — verify it before trusting any payload:

javascript

import crypto from "node:crypto";

export function verifyCredSignature(secret, body, header) {
  // header: "t=1746111845,v1=5f8a..."
  const { t, v1 } = Object.fromEntries(
    header.split(",").map((kv) => kv.split("="))
  );
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${body}`)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(v1),
    Buffer.from(expected)
  );
}

Delivery semantics

At-least-once delivery. Acknowledge with any 2xx status within 5 seconds; anything else is retried with exponential backoff.
Full delivery log. Every attempt — payload, signature, response code — is inspectable in the dashboard and via GET /v1/webhooks/{id}/deliveries.
Manual redelivery. Failed deliveries can be re-sent from the dashboard or API at any time.
Built-in inspector. No receiver yet? Point your endpoint at the built-in inspector to watch signed deliveries live — sign in and open Settings → Webhooks.

Beyond webhooks

For high-volume subscribers, the production roadmap includes streaming change feeds (server-sent events) and a data broker service for managed push/pull integration with SIS, LMS, and CRM platforms — with queueing, retry logic, and end-to-end data lineage tracking.