> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/about-integrations/webhook-model-reference.md).

# Webhook Model Reference

The available notification rules in Workbench Settings map to events and models that appear in the data key on the webhook payload.

For more information about events and webhook data models, see [Webhooks Setup for Workbench](/connect-your-technology/about-integrations/webhooks-setup-for-workbench.md).

## Events

The following table contains the mapping of rules to events, and the models used for each event.

| Event                                         | Model                                                                 | Rule Name                                   |
| --------------------------------------------- | --------------------------------------------------------------------- | ------------------------------------------- |
| `announcement_created`                        | [Announcement event](#announcement-event)                             | Announcement is created                     |
| `assembler_connected`                         | [Assembler event](#assembler-event)                                   | Assembler has a health status change        |
| `assembler_disconnected`                      | [Assembler event](#assembler-event)                                   | Assembler has a health status change        |
| `custom_rule_created`                         | [Context label event](#context-label-event)                           | Custom rule is created                      |
| `expel_alert_assigned`                        | [Expel Alert event](#expel-alert-event)                               | Expel alert is assigned to my org           |
| `expel_alert_closed`                          | [Expel Alert event](#expel-alert-event)                               | Expel alert is closed                       |
| `expel_alert_created`                         | [Expel Alert event](#expel-alert-event)                               | Expel alert is created                      |
| `expel_alert_reopened`                        | [Expel Alert event](#expel-alert-event)                               | Expel alert is reopened                     |
| `incident_assigned`                           | [Investigation event](#investigation-event)                           | Incident is assigned to my org              |
| `incident_closed`                             | [Investigation event](#investigation-event)                           | Incident is closed                          |
| `incident_created`                            | [Investigation event](#investigation-event)                           | Incident is created                         |
| `incident_downgraded`                         | [Investigative Action event](#investigative-action-event)             | Incident is downgraded                      |
| `incident_promoted`                           | <p><a href="#investigation-event">Investigation event</a></p><p> </p> | Incident is promoted                        |
| `incident_reopened`                           | [Investigation event](#investigation-event)                           | Incident is reopened                        |
| `investigation_alert_added`                   | [Expel Alert event](#expel-alert-event)                               | Investigation has an alert added            |
| `investigation_assigned`                      | [Investigation event](#investigation-event)                           | Investigation is assigned to my org         |
| `investigation_manual_remediations_completed` | [Investigation event](#investigation-event)                           | Investigation is assigned to my org         |
| `investigation_closed`                        | [Investigation event](#investigation-event)                           | Investigation is closed                     |
| `investigation_created`                       | [Investigation event](#investigation-event)                           | Investigation is created                    |
| `investigation_manual_remediations_completed` | [Investigation event](#investigation-event)                           | Investigation manual remediations completed |
| `investigative_action_manual_action`          | [Investigative Action event](#investigative-action-event)             | Investigative action has manual action      |
| `investigative_action_assigned`               | [Investigative Action event](#investigative-action-event)             | Investigative action is assigned            |
| `investigative_action_analysis_assigned`      | [Investigative Action event](#investigative-action-event)             | Investigative action is assigned to me      |
| `investigative_action_assigned`               | [Investigative Action event](#investigative-action-event)             | Investigative action is assigned to me      |
| `investigative_action_analysis_assigned`      | [Investigative Action event](#investigative-action-event)             | Investigative action is assigned to my org  |
| `investigative_action_assigned`               | [Investigative Action event](#investigative-action-event)             | Investigative action is assigned to my org  |
| `investigative_action_analysis_assigned`      | [Investigative Action event](#investigative-action-event)             | Investigative action analysis is assigned   |
| `notify_action_assigned`                      | [Investigative Action event](#investigative-action-event)             | Notify action is assigned to my org         |
| `remediation_action_assigned`                 | [Remediation Action event](#remediation-action-event)                 | Remediation action is assigned to me        |
| `remediation_action_automation_failed`        | [Remediation Action asset event](#remediation-action-asset-event)     | Remediation action is assigned to me        |
| `remediation_action_assigned`                 | [Remediation Action event](#remediation-action-event)                 | Remediation action is assigned to my org    |
| `remediation_action_automation_failed`        | [Remediation Action asset event](#remediation-action-asset-event)     | Remediation action is assigned to my org    |
| `remediation_action_automated`                | [Remediation Action event](#remediation-action-event)                 | Remediation action is automated             |
| `security_device_first_healthy`               | [Security device event](#security-device-event)                       | Security device has a health status change  |
| `security_device_healthy`                     | [Security device event](#security-device-event)                       | Security device has a health status change  |
| `security_device_unhealthy`                   | [Security device event](#security-device-event)                       | Security device has a health status change  |
| `security_device_first_healthy`               | [Security device event](#security-device-event)                       | Security device is first healthy            |
| `verify_action_approved`                      | [Investigative Action event](#investigative-action-event)             | Verify action has outcome                   |
| `verify_action_denied`                        | [Investigative Action event](#investigative-action-event)             | Verify action has outcome                   |
| `verify_action_approved`                      | [Investigative Action event](#investigative-action-event)             | Verify action is assigned to me             |
| `verify_action_assigned`                      | [Investigative Action event](#investigative-action-event)             | Verify action is assigned to me             |
| `verify_action_denied`                        | [Investigative Action event](#investigative-action-event)             | Verify action is assigned to me             |
| `verify_action_acknowledged`                  | [Investigative Action event](#investigative-action-event)             | Verify action is assigned to my org         |
| `verify_action_approved`                      | [Investigative Action event](#investigative-action-event)             | Verify action is assigned to my org         |
| `verify_action_assigned`                      | [Investigative Action event](#investigative-action-event)             | Verify action is assigned to my org         |
| `verify_action_denied`                        | [Investigative Action event](#investigative-action-event)             | Verify action is assigned to my org         |
| `verify_action_unacknowledged`                | [Investigative Action event](#investigative-action-event)             | Verify action is assigned to my org         |

## Data Models

The following tables contain key-value models for specific webhook events.

### Announcement Event

| Key               | Value                                                                                                                                                                                                                                                                                                                                                                                            |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `announcement_id` | string                                                                                                                                                                                                                                                                                                                                                                                           |
| `change_action`   | string                                                                                                                                                                                                                                                                                                                                                                                           |
| `current`         | <p>array of:</p><p></p><p>{</p><p>id: string,</p><p>created\_at: timestamp,</p><p>updated\_at: timestamp,</p><p>created\_by\_id: string,</p><p>updated\_by\_id: string,</p><p>announcement\_type: one of \[ANNOUNCEMENT\_TYPE\_HOLIDAY, </p><p>ANNOUNCEMENT\_TYPE\_THREAT\_BULLETIN, </p><p>ANNOUNCEMENT\_TYPE\_TESTING, </p><p>ANNOUNCEMENT\_TYPE\_GENERAL], </p><p>message: string</p><p>}</p> |
| `previous`        | <p>array of:<br></p><p>{</p><p>id: string,</p><p>created\_at: timestamp,</p><p>updated\_at: timestamp,</p><p>created\_by\_id: string,</p><p>updated\_by\_id: string,</p><p>announcement\_type: one of \[ANNOUNCEMENT\_TYPE\_HOLIDAY, </p><p>ANNOUNCEMENT\_TYPE\_THREAT\_BULLETIN, </p><p>ANNOUNCEMENT\_TYPE\_TESTING, </p><p>ANNOUNCEMENT\_TYPE\_GENERAL], </p><p>message: string</p><p>}</p>    |

### Assembler Event

| Key                | Value                                                                     |
| ------------------ | ------------------------------------------------------------------------- |
| `assembler_id`     | string                                                                    |
| `change_action`    | string                                                                    |
| `current`          | [Assembler](https://workbench.expel.io/api/v2/docs/#tag/assemblers)       |
| `previous`         | [Assembler](https://workbench.expel.io/api/v2/docs/#tag/assemblers)       |
| `organization`     | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations) |
| `created_by_actor` | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)               |
| `updated_by_actor` | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)               |
| `deleted_by_actor` | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)               |

### Context Label Event

| Key                     | Value                                                                                            |
| ----------------------- | ------------------------------------------------------------------------------------------------ |
| `context_label_id`      | string                                                                                           |
| `change_action`         | string                                                                                           |
| `current`               | [ContextLabel](https://workbench.expel.io/api/v2/docs/#tag/context_labels)                       |
| `previous`              | [ContextLabel](https://workbench.expel.io/api/v2/docs/#tag/context_labels)                       |
| `organization`          | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                        |
| `context_label_actions` | array of [ContextLabelAction](https://workbench.expel.io/api/v2/docs/#tag/context_label_actions) |
| `investigations`        | array of [Investigation](https://workbench.expel.io/api/v2/docs/#tag/investigations)             |

### Expel Alert Event

| Key                       | Value                                                                       |
| ------------------------- | --------------------------------------------------------------------------- |
| `expel_alert_id`          | string                                                                      |
| `change_action`           | string                                                                      |
| `current`                 | [ExpelAlert](https://workbench.expel.io/api/v2/docs/#tag/expel_alerts)      |
| `previous`                | [ExpelAlert](https://workbench.expel.io/api/v2/docs/#tag/expel_alerts)      |
| `organization`            | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)   |
| `vendor`                  | [Vendor](https://workbench.expel.io/api/v2/docs/#tag/vendors)               |
| `vendor_id`               | Vendor Event ID                                                             |
| `investigation`           | [Investigation](https://workbench.expel.io/api/v2/docs/#tag/investigations) |
| `updated_by_user_account` | [UserAccount](https://workbench.expel.io/api/v2/docs/#tag/user_accounts)    |

### Investigation Event

| Key                               | Value                                                                                                                                                                                                                                                                                                                    |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `investigation_id`                | string                                                                                                                                                                                                                                                                                                                   |
| `change_action`                   | string                                                                                                                                                                                                                                                                                                                   |
| `current`                         | [Investigation](https://workbench.expel.io/api/v2/docs/#tag/investigations)                                                                                                                                                                                                                                              |
| `previous`                        | [Investigation](https://workbench.expel.io/api/v2/docs/#tag/investigations)                                                                                                                                                                                                                                              |
| `organization`                    | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                |
| `created_by_organization`         | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                |
| `update_by_organization`          | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                |
| `created_by_user_account`         | [UserAccount](https://workbench.expel.io/api/v2/docs/#tag/user_accounts)                                                                                                                                                                                                                                                 |
| `updated_by_user_account`         | [UserAccount](https://workbench.expel.io/api/v2/docs/#tag/user_accounts)                                                                                                                                                                                                                                                 |
| `lead_expel_alert`                | [ExpelAlert](https://workbench.expel.io/api/v2/docs/#tag/expel_alerts)                                                                                                                                                                                                                                                   |
| `investigation_findings`          | array of [InvestigationFinding](https://workbench.expel.io/api/v2/docs/#tag/investigation_findings)                                                                                                                                                                                                                      |
| `previous_assigned_to_org`        | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                |
| `current_assigned_to_org`         | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                |
| `remediation_action_asset_groups` | <p>array of:<br></p><p>{</p><p>remediation\_action:<a href="https://workbench.expel.io/api/v2/docs/#tag/remediation_actions"> RemediationAction</a>, </p><p>remediation\_action\_assets: array of<a href="https://workbench.expel.io/api/v2/docs/#tag/remediation_action_assets"> RemediationActionAsset</a></p><p>}</p> |
| `organization_resilience_actions` | array of [OrganizationResilienceAction](https://workbench.expel.io/api/v2/docs/#tag/organization_resilience_actions)                                                                                                                                                                                                     |
| `is_detect_only`                  | boolean                                                                                                                                                                                                                                                                                                                  |
| `engagement_manager`              | [EngagementManager](https://workbench.expel.io/api/v2/docs/#tag/engagement_managers)                                                                                                                                                                                                                                     |

### Investigative Action Event

| Key                                   | Value                                                                                             |
| ------------------------------------- | ------------------------------------------------------------------------------------------------- |
| `investigative_action_id`             | string                                                                                            |
| `change_action`                       | string                                                                                            |
| `current`                             | [InvestigativeAction](https://workbench.expel.io/api/v2/docs/#tag/investigative_action_histories) |
| `previous`                            | [InvestigativeAction](https://workbench.expel.io/api/v2/docs/#tag/investigative_action_histories) |
| `created_by_actor`                    | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                       |
| `vendor`                              | [Vendor](https://workbench.expel.io/api/v2/docs/#tag/vendors)                                     |
| `vendor_id`                           | Vendor Event ID                                                                                   |
| `organization`                        | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                         |
| `previous_assigned_to_actor`          | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                       |
| `current_assigned_to_actor`           | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                       |
| `previous_analysis_assigned_to_actor` | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                       |
| `current_analysis_assigned_to_actor`  | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                       |
| `investigation`                       | [Investigation](https://workbench.expel.io/api/v2/docs/#tag/investigations)                       |
| `completed_by_organization`           | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                         |
| `file`                                | [File](https://workbench.expel.io/api/v2/docs/#tag/files)                                         |
| `uploaded_by_actor`                   | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                       |
| `completed_by_actor`                  | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                       |
| `updated_by_actor`                    | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                       |
| `lead_expel_alert`                    | [ExpelAlert](https://workbench.expel.io/api/v2/docs/#tag/expel_alert_thresholds)                  |

### Remediation Action Event

| Key                                         | Value                                                                                                                                                                                                                                                                                                                                  |
| ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `remediation_action_id`                     | string                                                                                                                                                                                                                                                                                                                                 |
| `change_action`                             | string                                                                                                                                                                                                                                                                                                                                 |
| `current`                                   | [RemediationAction](https://workbench.expel.io/api/v2/docs/#tag/remediation_actions)                                                                                                                                                                                                                                                   |
| `previous`                                  | [RemediationAction](https://workbench.expel.io/api/v2/docs/#tag/remediation_actions)                                                                                                                                                                                                                                                   |
| `created_by_actor`                          | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                                                                                                                                                                                                                                                            |
| `created_by_organization`                   | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                              |
| `updated_by_actor`                          | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                                                                                                                                                                                                                                                            |
| `updated_by_organization`                   | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                              |
| `completed_by_actor`                        | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                                                                                                                                                                                                                                                            |
| `completed_by_organization`                 | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                              |
| `organization`                              | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                              |
| `previous_assigned_to_actor`                | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                                                                                                                                                                                                                                                            |
| `current_assigned_to_actor`                 | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                                                                                                                                                                                                                                                            |
| `previous_assigned_to_org`                  | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                              |
| `current_assigned_to_org`                   | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                              |
| `investigation`                             | [Investigation](https://workbench.expel.io/api/v2/docs/#tag/investigations)                                                                                                                                                                                                                                                            |
| `remediation_action_assets`                 | array of [RemediationActionAsset](https://workbench.expel.io/api/v2/docs/#tag/remediation_action_assets)                                                                                                                                                                                                                               |
| `remediation_asset_context_label_tags`      | <p>array of:<br></p><p>{</p><p>remediation\_action\_asset\_id: string,</p><p>context\_label\_tag\_descriptions: array of string</p><p>}</p>                                                                                                                                                                                            |
| `remediation_action_assets_by_device_names` | <p>array of:<br></p><p>{</p><p>\<device name 1>: array of<a href="https://workbench.expel.io/api/v2/docs/#tag/remediation_action_assets"> RemediationActionAsset</a>,</p><p>\<device name 2>: array of<a href="https://workbench.expel.io/api/v2/docs/#tag/remediation_action_assets"> RemediationActionAsset</a>,</p><p>…</p><p>}</p> |
| `lead_expel_alert`                          | [ExpelAlert](https://workbench.expel.io/api/v2/docs/#tag/expel_alert_thresholds)                                                                                                                                                                                                                                                       |
| `is_awaiting_checks`                        | boolean                                                                                                                                                                                                                                                                                                                                |
| `previous_is_awaiting_checks`               | boolean                                                                                                                                                                                                                                                                                                                                |

### Remediation Action Asset Event

| Key                                         | Value                                                                                                                                                                                                                                                                                                                                  |
| ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `remediation_action_asset_id`               | string                                                                                                                                                                                                                                                                                                                                 |
| `change_action`                             | string                                                                                                                                                                                                                                                                                                                                 |
| `current`                                   | [RemediationActionAsset](https://workbench.expel.io/api/v2/docs/#tag/remediation_action_assets)                                                                                                                                                                                                                                        |
| `previous`                                  | [RemediationActionAsset](https://workbench.expel.io/api/v2/docs/#tag/remediation_action_assets)                                                                                                                                                                                                                                        |
| `remediation_action`                        | [RemediationAction](https://workbench.expel.io/api/v2/docs/#tag/remediation_actions)                                                                                                                                                                                                                                                   |
| `remediation_action_assigned_to_actor`      | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                                                                                                                                                                                                                                                            |
| `remediation_action_assigned_to_org`        | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                              |
| `created_by_actor`                          | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                                                                                                                                                                                                                                                            |
| `created_by_organization`                   | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                              |
| `updated_by_actor`                          | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                                                                                                                                                                                                                                                            |
| `updated_by_organization`                   | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                              |
| `completed_by_actor`                        | [Actor](https://workbench.expel.io/api/v2/docs/#tag/actors)                                                                                                                                                                                                                                                                            |
| `completed_by_organization`                 | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                              |
| `organization`                              | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)                                                                                                                                                                                                                                                              |
| `investigation`                             | [Investigation](https://workbench.expel.io/api/v2/docs/#tag/investigations)                                                                                                                                                                                                                                                            |
| `remediation_asset_context_label_tags`      | <p>array of:<br></p><p>{</p><p>remediation\_action\_asset\_id: string,</p><p>context\_label\_tag\_descriptions: array of string</p><p>}</p>                                                                                                                                                                                            |
| `remediation_action_assets`                 | array of [RemediationActionAsset](https://workbench.expel.io/api/v2/docs/#tag/remediation_action_assets)                                                                                                                                                                                                                               |
| `remediation_action_assets_by_device_names` | <p>array of:<br></p><p>{</p><p>\<device name 1>: array of<a href="https://workbench.expel.io/api/v2/docs/#tag/remediation_action_assets"> RemediationActionAsset</a>,</p><p>\<device name 2>: array of<a href="https://workbench.expel.io/api/v2/docs/#tag/remediation_action_assets"> RemediationActionAsset</a>,</p><p>…</p><p>}</p> |
| `lead_expel_alert`                          | [ExpelAlert](https://workbench.expel.io/api/v2/docs/#tag/expel_alert_thresholds)                                                                                                                                                                                                                                                       |

### Security Device Event

| Key                  | Value                                                                          |
| -------------------- | ------------------------------------------------------------------------------ |
| `security_device_id` | string                                                                         |
| `change_action`      | string                                                                         |
| `current`            | [SecurityDevice](https://workbench.expel.io/api/v2/docs/#tag/security_devices) |
| `previous`           | [SecurityDevice](https://workbench.expel.io/api/v2/docs/#tag/security_devices) |
| `organization`       | [Organization](https://workbench.expel.io/api/v2/docs/#tag/organizations)      |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/connect-your-technology/about-integrations/webhook-model-reference.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.