Feature × Audience

How do banks use Plugsky webhooks for audit and control?

Plugsky webhooks push signed events to an HTTPS endpoint you control, so banks can automate instead of poll. Deliveries are HMAC-SHA256 signed and cover nine event types, including quota.warning, key.rotated, usage.threshold, invoice.paid, model.deprecated and audit.alert. Return 2xx quickly, process asynchronously, and make handlers idempotent because delivery is at-least-once.

Key facts

TransportHTTPS endpoint you host
SignatureHMAC-SHA256 signed deliveries
Event typesquota.warning, quota.exceeded, key.rotated, model.deprecated, usage.threshold, invoice.paid, audit.alert, batch.completed, fine_tuning.completed
ConfigurationDashboard → Webhooks
Response handlingReturn 2xx quickly; process asynchronously
Delivery semanticsAt-least-once; design idempotent handlers
SIEM exportAudit events can flow to Splunk, Sentinel, QRadar and Chronicle
Status noteDeliveries are live; events tied to coming-soon endpoints depend on the roadmap

TL;DR

  • Signed HTTPS deliveries replace polling for platform events.
  • HMAC-SHA256 verification happens before any payload is parsed.
  • Nine event types cover quotas, keys, models, usage, invoicing and audit.
  • Map quota.warning to capacity planning for scoring traffic, key.rotated to the key ceremony record, model.deprecated to the model risk register, and audit.alert to the SIEM incident queue.
  • Handlers must be idempotent because delivery is at-least-once.

How it works, step by step

  1. List the platform events your banking workflows should react to.
  2. Stand up an HTTPS endpoint you control and register it in Dashboard → Webhooks.
  3. Verify the HMAC-SHA256 signature over the raw body before parsing.
  4. Return 2xx quickly and enqueue the event for asynchronous processing.
  5. Make handlers idempotent so retries and duplicates are safe.
  6. Add a dead-letter queue and alert when deliveries fail repeatedly.
  7. Replay test events against a staging endpoint before production cut-over.
1List the platformevents your bankingworkflows should2Stand up an HTTPSendpoint youcontrol and3Verify theHMAC-SHA256signature over the4Return 2xx quicklyand enqueue theevent for5Make handlersidempotent soretries and6Add a dead-letterqueue and alertwhen deliveries

Try it yourself

Open the API key security checklist →

Why banks should react to events

Banks already run AI where the compliance perimeter is defined: fraud scoring, AML and KYC review, credit memo drafting, complaint triage and internal search over policy. DORA, PCI DSS, SOC 2 and prudential model-risk rules all expect evidence that customer data, keys and change control stay inside the institution's boundary.

Bank platforms are event-driven by nature: limits breach, keys rotate, models retire and audits land. Webhooks let the AI platform feed those operational pipelines instead of adding a dashboard nobody watches.

How Plugsky webhooks work

Register an HTTPS endpoint in Dashboard → Webhooks. Plugsky delivers signed events to the endpoint you host; every delivery is HMAC-SHA256 signed, so verify the signature over the raw body before parsing. Nine event types are documented: quota.warning, quota.exceeded, key.rotated, model.deprecated, usage.threshold, invoice.paid, audit.alert, batch.completed and fine_tuning.completed. Return a 2xx quickly and process the event asynchronously; deliveries are at-least-once, so handlers must tolerate duplicates. Events tied to endpoints the docs still list as coming soon depend on the roadmap, so confirm availability before building on them.

Security and reliability patterns

Patterns that keep the integration small and defensible:

  • Verify the HMAC-SHA256 signature over the raw body before parsing anything.
  • Treat events as signals, not data: fetch details through authenticated API calls so payloads stay minimal.
  • Route audit.alert to the SIEM and key.rotated to the key ceremony record.
  • Make handlers idempotent and replay-safe, because delivery is at-least-once.

Putting webhooks to work

Map quota.warning to capacity planning for scoring traffic, key.rotated to the key ceremony record, model.deprecated to the model risk register, and audit.alert to the SIEM incident queue.

Start from the events that protect revenue and access: quota.warning, quota.exceeded, key.rotated and audit.alert. Add model.deprecated and usage.threshold as you automate more. The integration surface is small — one endpoint, one signature check, one idempotent handler — and the request path stays OpenAI-compatible, so nothing about your API calls changes. Self-serve plans are flat monthly with unlimited fair-use usage and no per-token billing; current plans are on the pricing page. Prototype on the free plan and use the 14-day full-access trial when you need larger models.

Honest comparison

FactorPlugsky webhooksPolling the APIBuilding an event bus in-house
Delivery modelPush, HTTPS, HMAC-SHA256 signedPull on a scheduleYou design and operate it
Event coverageNine platform event typesWhatever you remember to queryOnly what you instrument
Ops overheadLow — endpoint plus handlerLow but laggyHigh — queues, retries, on-call
Reaction timeSeconds after the eventNext poll intervalDepends on your pipeline
Audit pathaudit.alert plus SIEM exportManual log queriesYou build the trail
Time to integrateHoursHoursWeeks

Frequently asked questions

Do webhook payloads contain sensitive data?

Design for minimal payloads: treat events as signals and fetch details through the authenticated API. Verify the HMAC-SHA256 signature over the raw body before parsing anything.

Can we keep using the OpenAI SDK?

Yes. The request path stays OpenAI-compatible, so you change the base URL and model names and keep your existing SDK code, prompts and evaluations.

How do I verify a webhook signature?

Compute an HMAC-SHA256 over the raw request body with your signing secret and compare it to the signature header in constant time before parsing the payload.

What happens if our endpoint is down?

Delivery is at-least-once and retried, so events may arrive again after recovery. Keep a dead-letter queue, alert on repeated failures, and make handlers idempotent.

Can deliveries be duplicated or reordered?

Treat delivery as at-least-once: deduplicate by event identity and process per entity where order matters rather than assuming a strict global sequence.

What should the endpoint return?

Return a 2xx quickly before doing the work, then process the event asynchronously so a slow downstream job cannot cause retries.

How is pricing structured?

Webhooks are part of the platform: self-serve plans are flat monthly with unlimited fair-use usage and no per-token billing. See the live pricing page for current plans.

Is there a free plan?

Yes — the free plan includes plugsky-micro and plugsky-lite with no credit card, and a 14-day full-access trial covers larger models.