Skip to main content
Allocait can push a notification to your own endpoint when a portfolio’s compliance status changes, or when one of your monitors confirms, retraces or clears a level at the close. These are the only events Allocait sends to a webhook endpoint. They report the close against your own rules and levels; there’s no real-time feed. Webhooks are set up in the app or through the REST API only. No MCP tool manages them. Adding, changing and deleting an endpoint needs Read and change access (see what each level of access allows). An account that loses that access keeps its endpoints, and Allocait stops sending to them.

​
When webhooks fire

Allocait checks compliance once each weekday, after the US market closes and it has recorded closing prices for your symbols. It checks each portfolio against its active scenario. A portfolio with no active scenario isn’t checked, and sends no compliance events. If the closing prices aren’t all in, the close job tries again on its next scheduled run that evening. If they still aren’t in, the check waits for the next weekday’s run and reports any change since the last check. Allocait compares the result to the last snapshot it saw for that portfolio. Dispatch is diff-based: a breach only triggers compliance.violation the moment it newly appears, and only triggers compliance.resolved the moment it clears. A breach that lasts across two checks doesn’t fire again. The check covers every rule the app checks: each asset class against its allocation band (Cash included, and a class you hold nothing in counts as 0%), and each holding against its class’s range for its side: the position size range for a long, the short size range for a short. Only a 2xx answer counts as delivered. Allocait retries a failed delivery up to twice during the run, one to two seconds apart, when the failure could clear by itself: a connection error, a 429 or a 5xx answer. A receiver that doesn’t answer within 5 seconds usually gets no retry in the same run. If no endpoint accepts an event for one of those reasons, Allocait sends it again on the next weekday’s run. For monitor events it stops after seven days. A refused URL or any other 4xx answer isn’t sent again. Because a retry can reach an endpoint that already processed the first attempt, make your handler safe to call twice for the same event. Order monitor events by session_date, not by arrival.

​
Setting up an endpoint

1

Open the Webhooks tab

Go to Settings > Webhooks and select Add endpoint.
2

Enter your URL and choose events

Enter the URL Allocait should POST to, then tick the events you want: Out of range (compliance.violation), Back in range (compliance.resolved) and Monitor events (monitor.confirmed, monitor.retraced, monitor.cleared). The URL must start with https://, point to a public host on port 443, and respond within 5 seconds with a 2xx status. Allocait doesn’t follow redirects. Each URL can be added once, and an account can have 20 endpoints.
3

Save the secret

Allocait shows the signing secret once, after you add the endpoint. Copy it before you close the dialog. If you lose it, delete the endpoint and add a new one.

​
Manage endpoints from code

The API manages the same endpoints as the app. Use GET /webhooks to list them, POST /webhooks to add one (the response returns the signing secret once), PATCH /webhooks/{id} to change the URL or events or to pause it with is_active: false, and DELETE /webhooks/{id} to remove it. Adding, changing and deleting need an API key with the write permission on an account with Read and change access. See the API introduction.

​
Next steps

Webhook events

The events and the fields in each payload.

Verify deliveries

Check the signature on each delivery.