Claude Managed Agents Webhooks

When to Use This Skill

• Setting up Claude Managed Agents (CMA) webhook handlers
• Debugging Anthropic webhook signature verification failures
• Handling agent session state changes (session.status_idled, session.status_terminated)
• Reacting to multiagent thread events (session.thread_created, session.thread_idled)
• Processing vault and credential events (vault.created, vault_credential.refresh_failed)
• Replacing long-poll loops on the Sessions API with push notifications

Essential Code (USE THIS)

CMA webhooks follow the Standard Webhooks spec. Every delivery carries three headers — webhook-id, webhook-timestamp, and webhook-signature — and is signed with HMAC-SHA256 over {webhook-id}.{webhook-timestamp}.{raw-body}. The signing secret is the whsec_-prefixed value shown once at endpoint creation. The Anthropic SDK exposes client.beta.webhooks.unwrap() which wraps the same verification. Manual verification is shown here because it works in every framework without an extra SDK dependency.

Express Webhook Handler