Interview settings and webhooks

Set the candidate notice and data retention before sending interview links. Completion webhooks send the finished debrief packet to an endpoint you control.

Interview settings are available on every plan and require interviews:manage. Practice interviews never send completion webhooks.

Change the organization settings

1. Open the organization name in the sidebar, then select Organization Settings > Interviews.
2. Turn on Enable Interviews to make interview routes and candidate links available.
3. Adjust the controls below, then select Save changes.

Control	Effect
Days after interview completion	Sets retention from the session's end time. The default is 365 days. Enter 0 to keep data until manually removed, or a whole number up to 3,650 days.
Require consent	Requires the candidate to accept the notice before joining.
Custom notice	Replaces the default notice text. Leave it blank to use the default and check Candidate preview.
Blind independent scoring	Controls whether panel results wait for scorecard submission. See the result access rules.
Live interviewer assist	Allows AI follow-up suggestions during an interview.
Debrief drafting	Allows AI evidence drafts for scorecards.
Record canvas snapshots	Saves frames for replay. Turning it off stops new replay frames.

Enabling either AI option adds an AI notice to the candidate notice. Drawing and note taking work without AI, as do human scorecards.

Turning an option on doesn't lift the other requirements: interview AI still needs Team or above, ai:use and available AI credits.

Changing retention also recalculates the purge deadline for interviews that have already ended and haven't been purged. After that deadline, ArchDocs clears the session's candidate name and email fields, removes drawings and snapshots, and redacts note bodies, score evidence and summaries. Numeric ratings and recommendations remain. The interview title, practice account link and candidate feedback also remain, so this isn't complete anonymization. Copies you've exported or sent to a webhook aren't removed by this purge.

Add a completion endpoint

Webhooks can be managed once Enable Interviews is on.

1. Under Completion webhook, enter a public HTTPS endpoint in Webhook URL and select Add.
2. Use Copy under Copy this signing secret now to store the secret, then select I saved it. The secret can't be retrieved again after leaving the page.
3. Select the Test webhook icon to attempt a delivery using the latest completed interview. If there isn't one, no packet is sent. If the latest completed interview is practice, delivery is skipped.

Completion means all interviewers have submitted their scorecards, rather than just that the drawing session has ended. On completion, ArchDocs attempts one HTTP POST to each active endpoint with the same structured packet as the JSON debrief export. The packet includes candidate identity, panel ratings and recommendations, evidence and session details. Restrict access to the received data.

Verify the signature

Requests use these headers:

Content-Type: application/json
X-Archdocs-Event: interview.completed
X-Archdocs-Signature: sha256=<lowercase hexadecimal digest>

The signature is an HMAC-SHA256 of the exact raw UTF-8 request body, using that endpoint's secret. Verify it before parsing the body. Recreating JSON from a parsed object can change the bytes and break verification.

The request body is the packet itself, serialized with JSON.stringify(packet), without an additional wrapper or timestamp prefix.

This Node.js function takes the raw request body as a Buffer, the signature header and your stored secret:

import { createHmac, timingSafeEqual } from 'node:crypto'

function verifySignature(rawBody: Buffer, header: string, secret: string): boolean {
  const expected = 'sha256=' + createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex')
  const received = Buffer.from(header, 'utf8')
  const signed = Buffer.from(expected, 'utf8')
  return received.length === signed.length && timingSafeEqual(received, signed)
}

Pass the untouched body bytes from your HTTP framework. Reject an invalid signature, then parse valid JSON and check that both the event header and the body's event are interview.completed. Process each interview ID idempotently so a test delivery doesn't duplicate work.

Handle delivery failures

Return a 2xx response after accepting the event. Delivery times out after 10 seconds, and redirects aren't followed. A 2xx response resets the endpoint's failure count; other responses or network failures increment it. Ten consecutive failures deactivate the endpoint.

There's no timed automatic retry queue. Check the endpoint's last status and failure count, fix the receiver and use Test webhook for another attempt with the latest completed interview. The settings page has no reactivation control. For an inactive endpoint, use Delete webhook and add it again, then store its new signing secret. Use JSON export for a particular older interview.