Webhooks

Dimmi can POST events to your HTTPS endpoints when cases progress, permits or certificates are granted, or Global monitoring detects elevated risk for people abroad.

Setup (portal only)

1. In Admin → Developers, create a webhook with a public https:// URL and the events you need.
2. Store the webhook signing secret (shown once).
3. Verify each delivery using the X-Dimmi-Signature header.

Webhook URLs must be public HTTPS (no private/literal IPs) — Dimmi rejects unsafe URLs.

There is no partner API to create or update webhooks with an API key. Use the Developers screen (and its deliveries list when troubleshooting).

Envelope

{
  "id": "<event-uuid>",
  "type": "permit.granted",
  "created_at": "2026-08-02T12:00:00Z",
  "data": { }
}

Events

Event	When
case.created	A case is created
case.status_changed	Case status changes
case.document_uploaded	A document is attached
case.linked	A linked/settling child case is attached to a parent
permit.granted	Immigration case reaches permit acquired
permit.expiring	Permit enters expires-soon
permit.expired	Permit expired
certificate.granted	A1/S1 (or similar) certificate issued
assignment.created	Cross-border assignment journey created
monitoring.employee_at_risk	Advisory/crisis exposure for a person
monitoring.crisis_alert	Organisation-level crisis/advisory alert

For full-service cases, Dimmi may deliver to webhooks on both the client organisation and the handling organisation when both have subscriptions.

Signature verification

Header format (Stripe-style):

X-Dimmi-Signature: t=<unix_ts>,v1=<hmac_sha256_hex>

Compute HMAC-SHA256 of {t}.{raw_body} with your webhook secret and compare to v1 using a constant-time compare. Reject stale timestamps.