Skip to main content
SEC API delivers signed events to organization webhook endpoints. The public event catalog is the authority for available event types; do not invent a filing event name in a receiver configuration.

​
The monitor event

monitor.match is emitted when a saved filing monitor finds new matches during its scheduled dispatch. It is a notification to retrieve and assess the identified filing. It does not guarantee immediate EDGAR publication or imply a materiality judgment. For each received event, preserve the event id, type, created time, monitor id, match accession numbers, source URLs, and requestId when present. These values connect a downstream alert to the source record and the delivery audit trail.

​
Signature and retry posture

Verify x-secapi-signature over the exact raw body before parsing JSON. Check the signature timestamp against a bounded clock-skew window and compare signatures in constant time. Never log the signing secret, and do not treat an unsigned body as a trusted event. Make processing idempotent on event or delivery identifiers. Return quickly after a durable queue write, then perform slow filing enrichment outside the request. A retry can repeat a valid notification; it should not produce duplicate analyst alerts.

​
Human-only controls

Create endpoints, rotate secrets, issue test events, change subscriptions, inspect control-plane state, and replay delivery from the signed-in dashboard. API keys are for machine reads; they do not grant control-plane authority. Use Webhook delivery audit for a failed attempt, Monitor SEC filing events to define the matching job, and Build a filing monitor for a runnable signature verifier.