Skip to main content
WEBHOOK

Authorizations

Authorization
string
header
required

Static bearer credential supplied by the CAD endpoint owner during onboarding. It is required only when the provisioned connector security profile includes WebhookBearer.

X-GWX-Signature
string
header
required

HMAC-SHA-256 signature formatted as v1=<lowercase-hex-digest>. The digest is computed with the UTF-8 bytes of the registered shared secret over these exact bytes, without whitespace normalization or JSON reserialization:

<X-GWX-Timestamp>.<X-GWX-Delivery-Id>.<raw-request-body>

Recipients must compare digests in constant time and require the timestamp to be within 300 seconds of their current time before applying the selected reliability profile. durable_idempotent recipients also enforce the expiration conveyed by their connector profile and durably serialize the business action by delivery ID. bounded_deduplication recipients apply the retention bound declared by their connector profile. A repeated ID with a different body is rejected whenever the selected profile supports deduplication.

Headers

X-GWX-Delivery-Id
string<uuid>
required

Identifier for one logical delivery to one recipient. Durable retry is planned. The selected connector reliability profile determines whether this value is durably stored, retained in a bounded cache, or unavailable for safe deduplication. Every permitted retry uses this same value and exact raw request body with a fresh timestamp and signature.

X-GWX-Event
enum<string>
required

Must match the eventType value in the request body.

Available options:
incident.call_type.recommended,
incident.comment.added,
incident.dispatch.recommended,
incident.interaction.completed
X-GWX-Origin
enum<string>
required

catchup identifies a update produced before the CAD interaction was linked. live identifies a update produced during normal live flow.

Available options:
catchup,
live
X-GWX-Timestamp
integer<int64>
required

Unix time in whole seconds when this delivery attempt was signed. It is required by the baseline replay-protected HMAC profile. Each retry receives a fresh timestamp and signature. Compatibility profiles may override this requirement when the vendor cannot support it.

Body

application/json
eventId
string<uuid>
required

Identifier of the vendor-neutral business event.

eventType
string
required
Allowed value: "incident.dispatch.recommended"
deliveryId
string<uuid>
required

Must match X-GWX-Delivery-Id.

correlationId
string
required

Required before a CAD incident identifier is available.

Required string length: 1 - 100
occurredAt
string<date-time>
required

Time the recommendation was produced.

data
object
required
cadIncidentId
string | null

CAD-assigned target identifier when known.

Required string length: 1 - 200

Response

The CAD accepted the delivery. Under durable_idempotent or bounded_deduplication, a delivery ID still inside the profile's retention bound is acknowledged without repeating the business action.

ok
boolean
required
deliveryId
string<uuid>
required