Clearance loop

Webhooks

Product delivery path (API / worker), not part of the SDARC cryptographic core. Register endpoints under /v1/webhook-endpoints. PATCH to enable or disable and to set enabled_events (per-endpoint subscriptions). POST .../test enqueues endpoint.test only when that event is enabled. URL admission blocks non-http(s) schemes and cloud-metadata SSRF targets; localhost is allowed in sandbox for local receivers.

Lifecycle events: clearance_intent.created, clearance_intent.succeeded, clearance_intent.cancelled (API cancel or Element decline). The worker delivers with ZeroGrant-Event-Id, ZeroGrant-Timestamp, ZeroGrant-Signature, ZeroGrant-Api-Version, plus legacy x-zerogrant-signature. Retry via POST /v1/webhook-deliveries/{id}/retry.

Verify with @zerogrant/node / @zerogrant/webhook-contracts. See examples/express-webhook and run npm run dev:example-webhook.