Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

I also have a question on webhooks. :hook:  We are going to try to implement a flow-interrupting webhook to validate a cloudflare Turnstile token (<https://github.com/ory/kratos/issues/138#issuecomment-1450091446|inspired by this>).  We will therefore need to inspect the body of the webhook response and find `"success":true` (or `false`) and proceed accordingly.  Our questions:
1. Does Kratos self hosted include this flow-interrupting webhook ability
2. Does the webhook response to be parsed have to be ory trait structured JSON? It would be ideal to inspect the response directly from cloudflare and proceed accordingly.
3. Is there documentation on what the response body schema should be?
4. Is the only way to block a flow to have the webhook respond `4xx`, `5xx` ? 

I’m pretty sure the answers are as follows but confirmation would be reassuring.
1. Yes
2. Yes and no it doesn’t provide ability to extract and use fields from any body format.
3. Yes, as per the flow-interrupting webhook docs
4. Yes it must have these error http status codes
…. meaning we will need to have a service in between kratos and Turnstile.