Monitor entity changes and deliver actionable alerts

A Change Subscription selects canonical entities, fields, relationships, and cadence. Every Observed Change compares two accepted snapshots and retains evidence references. Graph Events remain low-level mutations; use Alerts & Changes when a consumer needs a stable business-level difference.

Create a subscription with changes:write. Run it manually or let its cadence trigger a scan. Enabled Alert Rules match severity, change type, entity, and field. A matching change creates one durable Alert and one delivery per configured channel, so delivery retries never duplicate the alert.

Entity IDs must already be canonical. Keep subscriptions narrow enough that their field and relationship scope reflects a real downstream decision.

curl -X POST https://api.enrich.nordicdevhouse.com/v1/change-subscriptions \
  -H "Authorization: Bearer enrich_live_••••••••" \
  -H "Content-Type: application/json" \
  -d '{"name":"Nordic account watch","entity_ids":["org_fi_2841842_1"],"fields":["employee_count","credit_status"],"cadence":"daily"}'

Rules require explicit severities, change types, and channels. Empty entity_ids or fields means all subscribed entities or fields. Webhook deliveries use the same signing controls as enrichment webhooks.

{
  "name": "Material account changes",
  "severities": ["high", "critical"],
  "change_types": ["field_changed", "relationship_added"],
  "fields": ["credit_status", "employee_count"],
  "channels": ["webhook", "email"]
}

Every write requires a request-specific Idempotency-Key. Delivery workers sign webhook bodies, reject redirects and private targets, and move exhausted retries to the dead-letter state. Configure the entity detector, delivery endpoints, a 32+ character signing secret, an explicit host allowlist, and the worker secret before enabling schedules. Retention defaults to 90 days and is applied by the authenticated worker.