1#### Manage and protect
2
3# Grok Bot inference hooks
4
5Inference hooks send every governed Grok Bot model request to an AI security
6server your organization runs or uses through a security vendor. Cursor signs
7each request, waits for an allow or deny verdict, and stops the request on a
8deny, so your policy checks prompts and the content Grok Bot gathers before a
9model sees them. For Grok Bot's other controls, see
10[Grok Bot security](/grok-bot/security).
11
12> **Beta** Inference hooks are in beta and available to all Enterprise teams.
13> Team admins can set them up from the dashboard. They cover Grok Bot only. See
14> [Coverage](#coverage).
15
16## How it works
17
18* **Each governed model request is checked.** Before Grok Bot calls a model,
19 Cursor sends your endpoint a signed `prompt` frame with the conversation so
20 far and holds the request until a verdict arrives or the timeout passes. A
21 turn that calls the model several times, for example between tool calls,
22 sends one frame per call.
23* **Your server decides.** `allow` lets the request go to the model. `deny`
24 stops it, ends the turn, and the member who sent the message sees a
25 [block notice](#what-members-see).
26* **Failures follow your mode.** When your endpoint times out, returns an
27 error, or answers with something other than a verdict, the [mode](#modes)
28 decides whether the request proceeds or is blocked. A failure never counts as
29 a deny.
30* **Only model inputs are checked.** Your endpoint judges what is about to go
31 to the model. A tool call and its result appear in a frame only after the
32 tool has run. Grok Bot's reply to a member is a tool call too, so the reply
33 reaches the member before any frame contains it. A deny stops the next model
34 call, not an action that already happened.
35
36## Set up inference hooks
37
38You need to be a team admin on an Enterprise team.
39
401. **Prepare your security server.** Create an inference hooks integration in
41 your security vendor's console, or host your own server that meets the
42 [endpoint requirements](#endpoint-requirements). The setup dialog's
43 **Security Vendor** list includes vendor presets with a setup checklist.
442. **Open Inference Hooks.** In the Cursor dashboard, select the team, then
45 open [Inference Hooks](https://cursor.com/dashboard/bot/inference-hooks)
46 from the **Security & Compliance** section of the Grok Bot page.
473. **Add the endpoint.** Click **Set Up Endpoint**, choose your vendor or
48 **Custom Endpoint**, and enter the **Endpoint URL** and any
49 **Custom Headers** your server needs, such as its API key. Cursor checks the
50 URL when you save.
514. **Copy the signing secret.** The first save that sets an endpoint generates
52 a signing secret starting with `whsec_` and shows it once. Paste it into your
53 vendor's webhook secret field, or your server's configuration, so it can
54 verify each request.
555. **Test the connection.** Click **Test Connection**. Cursor sends a synthetic
56 request and shows the verdict or the reason the check failed. A deny here
57 means your policy would block the test prompt, so fix that before you
58 enforce.
596. **Start in Shadow mode.** New configurations start in **Shadow Mode**. Turn
60 on **Enforce Verdicts** to start sending. Your endpoint receives every
61 covered request and denials are recorded in the audit log, but nothing is
62 blocked. Once the verdicts look right, set **Mode** under
63 **Failure Handling** to **Allow the Request** or **Block the Request**.
64
65Setting changes take effect within about a minute, and requests already in
66flight finish under the old settings.
67
68While an endpoint is saved, **Enforce Verdicts** is on, and Grok Bot is
69covered, in any mode and at any rollout percentage, Grok Bot skips some model
70calls it would otherwise make ahead of a turn, so replies can start more
71slowly.
72
73### Endpoint requirements
74
75* **Use an `https://` URL on port 443.** The host must be publicly routable and
76 present a certificate from a public certificate authority. Cursor refuses
77 private, loopback, and carrier-grade NAT addresses.
78* **Redirects and tunnels don't work.** Cursor doesn't follow redirects and
79 treats one as a failed check. Reverse-tunnel hosts aren't accepted.
80* **Keep secrets out of the URL.** The URL can't carry credentials, a query
81 string, or a fragment, because admins see it in plain text. Put credentials
82 in custom headers, which are stored encrypted. URLs are limited to 2,048
83 characters.
84* **Answer every request with a verdict.** Return HTTP 200 and a JSON verdict,
85 including for Test Connection. See [Verdicts](#verdicts).
86
87### Custom headers
88
89* **You can add up to 16 headers.** Names use letters, digits, and hyphens,
90 without underscores, up to 128 characters. Values are printable ASCII, up to
91 8,192 characters.
92* **Values are write-only.** After you save, the page shows header names only.
93 Changing any header means entering every value again.
94* **A new URL clears saved values.** Header values never go to an endpoint they
95 weren't saved for. After you change the URL, re-enter them in **Edit**. Until
96 you do, requests go out without them.
97* **Cursor owns some headers.** You can't add `Host`, `Cookie`, `User-Agent`,
98 `Accept-Encoding`, connection headers such as `Transfer-Encoding`,
99 client-address headers such as `X-Real-IP`, or any name starting with
100 `Content-`, `Proxy-`, `X-Forwarded-`, `Webhook-`, or `X-Cursor-`.
101
102### Signing secret
103
104Every request carries [Standard Webhooks](https://www.standardwebhooks.com)
105headers so your server can reject anything Cursor didn't send:
106
107| Header | Value |
108| --- | --- |
109| `webhook-id` | The frame's `request_id` |
110| `webhook-timestamp` | Unix time in seconds |
111| `webhook-signature` | `v1,` then the base64 HMAC-SHA256 of `{webhook-id}.{webhook-timestamp}.{raw body}`, keyed with the base64-decoded part of the secret after `whsec_` |
112
113Each request carries exactly one signature. To rotate the secret, click
114**Rotate Secret** under **Request Signing**. The new secret is shown once, and
115Cursor starts signing with it within about a minute, so keep accepting the
116previous secret until then. Rotating counts as a settings change for the
117[circuit breaker](#circuit-breaker).
118
119### Test Connection
120
121Test Connection sends a signed `prompt` frame with `source.application` set to
122`config-test`, a fixed message that contains no user content, and no member,
123session, or model. It signs with your saved secret and waits for your saved
124verdict timeout. It uses the URL and headers in the form when you run it from
125the endpoint dialog, and the saved ones when you run it from the page.
126
127| Result | Meaning |
128| --- | --- |
129| Allow or deny | Your server returned a verdict. Resolve a deny before you enforce |
130| URL rejected | The URL doesn't meet the endpoint requirements |
131| Private or internal IP | The host isn't a publicly routable address |
132| Timeout | No verdict arrived within the verdict timeout |
133| Transport error | DNS, connection, or TLS failure |
134| Non-200 status | Your server answered with a status other than 200, including a redirect |
135| Unparseable response | The body wasn't a JSON verdict, was compressed, or was larger than 64 KiB |
136| Signing secret required | Save the configuration first. Saving generates the secret |
137
138## Modes
139
140**Enforce Verdicts** turns sending on and off. While it's off, Cursor sends
141nothing and keeps your settings. While it's on, **Mode** decides what happens
142when a check can't finish:
143
144| Mode | On a deny | When the check fails |
145| --- | --- | --- |
146| **Shadow Mode** (default) | Lets the request through | Lets the request through |
147| **Allow the Request** | Blocks the request | Lets the request through uninspected (fails open) |
148| **Block the Request** | Blocks the request | Blocks the request (fails closed) |
149
150In Allow and Block modes the model request waits for the verdict. In Shadow
151mode Cursor sends the same frames at the same moments, but in the background:
152nothing waits, members see nothing, and denials and failures are recorded in
153the audit log. Under heavy load, Cursor can skip a Shadow check, and a skipped
154check writes no audit row.
155
156A check fails when your server times out, answers with a status other than 200,
157returns a body that isn't a JSON verdict or is larger than 64 KiB, returns an
158`action` other than `allow` or `deny`, or can't be reached. A frame larger than
15964 MiB also counts as a failure.
160
161Once Cursor has your settings, Block mode blocks every check that can't finish,
162including when the cause is on Cursor's side. If Cursor can't load your team's
163inference hook settings at all, it can't tell which mode you chose, so the
164request proceeds and the audit log records it as failed open with reason
165`config_unavailable`.
166
167### Verdict timeout
168
169**Verdict Timeout (ms)** accepts 1 to 10,000 ms and defaults to 5,000. It
170covers the whole exchange: connection, TLS handshake, request, and response. If
171the connection fails, Cursor retries once within the same timeout, with the
172same `webhook-id` and signature, so you can deduplicate on `webhook-id`. Cursor
173never retries after your server responds. Its own processing adds up to about
174half a second on top of the timeout.
175
176### Rollout
177
178**Requests Inspected (%)** sends only a share of covered requests to your
179endpoint while you bring it up. The choice is sticky, so all the requests
180behind one turn, subagents included, are either inspected or skipped. Requests
181outside the share proceed uninspected even in Block mode, and 0% turns
182inspection off.
183
184### Circuit breaker
185
186Sustained failures your server is responsible for, such as timeouts, error
187statuses, TLS errors, and malformed verdicts, trip the circuit breaker. DNS and
188connection errors, URLs Cursor refuses, and frames over 64 MiB count as
189failures but never trip it.
190
191* **While tripped, Cursor stops sending.** Your mode applies to every covered
192 request: Block mode blocks them all, and Allow and Shadow let them through
193 uninspected. The audit log records one
194 `inference_hooks_circuit_breaker_tripped` event per trip and no per-request
195 events while tripped.
196* **Recovery is automatic.** Starting 10 minutes after the trip, Cursor
197 periodically sends your server the Test Connection request. An allow or a
198 deny resets the breaker.
199* **Any settings change stops automatic recovery.** That includes rotating the
200 secret. Once your endpoint is fixed, click **Reset**, or turn
201 **Enforce Verdicts** off and on again.
202
203### Cursor pause
204
205Cursor can pause inference hooks for a team, or for everyone, in an emergency.
206While paused, Cursor sends no frames, covered requests proceed, and the audit
207log records most of them as failed open with reason `kill_switch`. Test
208Connection shows "Inference hooks are temporarily paused by Cursor."
209
210## What members see
211
212When your server denies a request, the Grok Bot desktop and mobile apps show a
213block notice to the member who sent the blocked message, in their own
214conversation with the Bot. On mobile, the notice sits above the message box. It
215shows:
216
217* The title **Blocked by your organization's policy**.
218* Your server's `deny_reason`, followed by your **Blocked Message**.
219* Guidance with an **Edit** button and a **Reset** button. **Edit** takes the
220 blocked message back out of the conversation and puts its text in the message
221 box, unless the member already has a draft there, so they can send something
222 different. **Reset** clears the conversation. The mobile app and newer
223 versions of the desktop app ask the member to confirm first. When Cursor
224 can't roll the conversation back to the point before the blocked message,
225 only **Reset** appears.
226
227**Blocked Message** accepts up to 500 characters and defaults to "Your
228organization's security policy blocked this request." Turn it off to show only
229your server's `deny_reason`. Use it to tell members what to do next, such as
230who to contact.
231
232After a reset, the Bot no longer sees earlier messages in that conversation,
233and it stops the background helpers it was running for it. Other work it
234started, such as cloud agents and background commands, keeps going and can
235report back. Its memory, files, routines, and settings are kept. Edit rolls the
236conversation back to the point before the blocked message. Neither one undoes
237actions the Bot already took, such as files it wrote.
238
239If the conversation is blocked again right after a reset, the notice has no
240buttons. It explains that what's blocked may be in the Bot's memory or files,
241and asks the member to remove it there or ask an admin for help.
242
243When a check fails in Block mode, the desktop app shows
244**Your organization's policy check is unavailable** and "Your organization
245requires a policy check before the model responds, and the check didn't
246complete. Try again later, or contact your admin if this keeps happening." The
247mobile app shows "Your organization's policy check is unavailable. Try again
248later, or contact your admin if this keeps happening." Your Blocked Message
249isn't shown, and there's no Edit or Reset.
250
251Other places show less:
252
253* **Shared Bots notify only the sender.** In a team Bot, the notice and its
254 buttons go only to the teammate who sent the blocked message, in their own
255 chat with the Bot, and Edit or Reset changes only that chat. The Bot's owner
256 isn't shown the deny reason or your Blocked Message. Rooms and group chats
257 get no Edit or Reset buttons.
258* **Slack replies in the conversation.** The Bot answers "Your organization's
259 policy blocked this conversation, so I can't reply," and in a one-to-one DM
260 it quotes the deny reason and your Blocked Message, which channel threads and
261 group DMs never show. The reply offers **Remove blocked message**, which
262 works like Edit, and **Reset**, which asks for confirmation first, or only
263 **Reset** when Cursor can't roll the conversation back. Anyone who can use
264 the Bot and has linked their Cursor account can click them. A removed message
265 stays visible in Slack, but the Bot no longer sees it. A repeat block right
266 after a reset gets no buttons, and a failed check in Block mode gets the
267 Bot's generic error reply instead of a policy notice.
268* **Elsewhere, the mobile app shows a plain failure.** In group chats and
269 conversations that aren't the member's own, it shows "Bot failed to respond"
270 with "Blocked by your organization's policy. Send a different message, or
271 contact your admin if this keeps happening," without the deny reason, your
272 Blocked Message, or buttons.
273* **Other Cursor apps show only the title.**
274* **Older desktop versions show no buttons.** Depending on the version, the
275 notice shows the deny reason and your Blocked Message with the guidance
276 "Send a different message, or start a new chat if this keeps happening," or
277 only "Blocked by your organization's policy. Send a different message, or
278 contact your admin if this keeps happening."
279* **Background helpers stop without a notice.** When a helper Grok Bot started
280 is blocked, the Bot learns your organization's policy stopped it, without the
281 deny reason.
282* **Routines stop and record the block.** The run history in the Cursor
283 dashboard shows **Blocked by your organization's policy**, or
284 **Your organization's policy check is unavailable** for a failed check in
285 Block mode, with a fixed explanation and no deny reason. The Grok Bot app's
286 routine list shows only that the run failed.
287* **Email, Linear, and other connected channels get no reply.**
288
289A blocked message stays in the conversation until someone takes it back or
290resets the conversation. Until then, Grok Bot sends it with every later
291request, so your server judges it again each time. A policy that scans the
292whole transcript keeps denying that conversation. A policy that judges the
293newest user message lets it continue once the member sends something
294different.
295
296Members see nothing when a request is allowed or when you're in Shadow mode.
297Shadow mode sends their conversations to your endpoint too, so tell members
298your organization checks Grok Bot requests before you turn on
299**Enforce Verdicts**.
300
301## Coverage
302
303**Covered:** the model requests behind your team members' Grok Bot
304conversations. That includes every step of a turn, subagents, the summaries
305Grok Bot writes of long conversations, and routines. A team Bot or room follows
306its team's inference hook. A personal Bot follows the team its owner has
307selected. Each request gets its own frame with the conversation so far.
308
309**Not covered:**
310
311* **Model responses aren't checked.** See [How it works](#how-it-works).
312* **Parts of a request that aren't conversation stay out.** System prompts,
313 tool definitions, and the model's hidden reasoning never go to your endpoint,
314 and Cursor leaves out most of the text it adds for the model, such as
315 reminders and timestamps.
316* **Ancillary model calls aren't sent.** These calls support a conversation
317 rather than continue it, such as writing chat titles, Auto Review, and saving
318 memories.
319* **Other Cursor features aren't covered.** That includes Cloud Agents, agents
320 in the editor, the CLI, the Agent SDK, Tab, embeddings, and local models.
321* **Actions aren't checked as they run.** Tool execution, connected-app
322 actions, and network traffic from a member's Grok Bot computer reach your
323 endpoint only when their output returns to the model as a tool result in a
324 later frame. Use the [network policy](/grok-bot/security#network-policy) and
325 [Auto Review](/grok-bot/security#approvals-and-auto-review) to control
326 actions.
327
328## Request format
329
330Cursor sends each frame as an HTTPS `POST` with a compact JSON body. Header
331names are lowercase.
332
333| Header | Value |
334| --- | --- |
335| `content-type` | `application/json` |
336| `user-agent` | `cursor-inference-hooks/1` |
337| `accept-encoding` | `identity` |
338| `webhook-id`, `webhook-timestamp`, `webhook-signature` | See [Signing secret](#signing-secret) |
339| Your custom headers | As saved |
340
341Standard headers such as `host` and `content-length` come with every request
342too.
343
344```json
345{
346 "type": "prompt",
347 "request_id": "req_6b1f0c2e-4d7a-4f1e-9a53-2c8d7e41b9a0",
348 "tenant_id": "team_4mQvT8yLcN2pR6",
349 "actor": {
350 "type": "user",
351 "id": "user_8hJw3KzP5sXq1V7nB2cF9mD4tR",
352 "email_address": null
353 },
354 "source": { "application": "grok-bot" },
355 "session_id": "3f2c9a71-58e4-4b0d-9c6a-0d1e7b25a4f8",
356 "model": "<Cursor model identifier>",
357 "messages": [
358 {
359 "role": "user",
360 "content": [
361 {
362 "type": "text",
363 "text": "Check the Q3 renewals sheet for accounts at risk and draft a note to the account team."
364 },
365 {
366 "type": "attachment",
367 "file_name": null,
368 "media_type": "image/png",
369 "size_bytes": 184320,
370 "text": null
371 }
372 ]
373 }
374 ],
375 "metadata": {}
376}
377```
378
379### Frame fields
380
381| Field | Value |
382| --- | --- |
383| `type` | Always `prompt` |
384| `request_id` | A unique ID for the request. It matches `webhook-id` and the audit log's `request_id` |
385| `tenant_id` | An opaque ID for your team |
386| `actor.type` | Always `user` |
387| `actor.id` | An opaque ID for the member who sent the message, or for a team service account. Null for Slack senders who haven't linked a Cursor account |
388| `actor.email_address` | Always null |
389| `source.application` | `grok-bot`, or `config-test` for Test Connection and circuit-breaker recovery checks |
390| `session_id` | An opaque ID for the Bot, shared across its chats and members, so it doesn't identify one conversation |
391| `model` | A Cursor model identifier. Use it for reporting, not allowlisting |
392| `messages` | The conversation so far. See [Messages](#messages) |
393| `metadata` | Always empty |
394
395### Messages
396
397* **Roles are `user` and `assistant`.** Tool results sit under `user`.
398* **Blocks are `text`, `tool_use`, `tool_result`, and `attachment`.** A
399 `tool_use` block names the tool and holds its `input`, and the matching
400 `tool_result` holds the output. Context Grok Bot gives the model, such as
401 rules, shared memory, and the connected apps it can use, usually arrives in
402 an `attachment` block's `text`. An image is an `attachment` with its media
403 type and size, but not its bytes or URL.
404* **Every frame holds the whole conversation so far.** Frames aren't deltas,
405 so each one carries the earlier messages again. In a long conversation, a
406 summary Grok Bot writes takes the place of older messages.
407* **Replies to members are tool calls.** Grok Bot sends what members read
408 through a tool, so its replies appear in `tool_use` input, not in assistant
409 `text`.
410* **Cursor never adds secret values.** Context can name and describe the
411 secrets a Bot can use, but never includes their values.
412
413### Write policies for these frames
414
415* **Verify the signature.** Don't rely on the User-Agent or source IP. If the
416 Inference Hooks page lists **Source IP Ranges** under **Request Signing**,
417 you can allowlist them as well.
418* **Treat IDs as opaque strings.** Don't parse `tenant_id` or `actor.id`. Map
419 members by `actor.id`, since frames carry no email.
420* **Treat `source.application` as an open set.** Cursor adds values as
421 coverage grows. It's advisory, not a security control.
422* **Scan every block type, not only `text`.** Context usually arrives in
423 attachment `text`, and replies to members and connected-app calls arrive in
424 `tool_use` input.
425* **Don't rely on `tool_result.is_error`.** It's `false` for most failed tool
426 calls too.
427
428### Verdicts
429
430Answer with HTTP 200 and a JSON object:
431
432```json
433{
434 "action": "deny",
435 "deny_reason": "This message contains a customer account number. Remove it and try again.",
436 "reference_id": "policy-7f3c21"
437}
438```
439
440* **`action`** is `allow` or `deny`. Anything else is a failed check.
441* **`deny_reason`** is shown in the block notice to the member who sent the
442 message. Cursor truncates it to 500 characters.
443* **`reference_id`** is your identifier for the decision, recorded in the
444 Cursor audit log. Up to 50 characters from `A-Z`, `a-z`, `0-9`, and `.`,
445 `_`, `:`, `/`, `-`. A malformed value is dropped and the deny still applies.
446* **Unknown fields are ignored.** Cursor reads at most 64 KiB, uncompressed,
447 and ignores cookies.
448
449Answer `config-test` frames from Test Connection and circuit-breaker recovery
450with a verdict too, and keep them out of your reports on member traffic.
451
452## Audit log
453
454Inference hook activity appears in your team's
455[audit log](https://cursor.com/docs/enterprise/compliance-and-monitoring#audit-logs).
456Payloads carry identifiers and codes, never prompt content, the deny reason,
457the signing secret, or header values. An allowed request writes no event.
458
459| `event_type` | When it fires | Fields |
460| --- | --- | --- |
461| `inference_hooks_config_updated` | An admin saves settings or resets the circuit breaker, or automatic recovery resets it | `action` (`update`, `reset_circuit_breaker`, `circuit_breaker_recovered`), `changed_fields`, `enforce_verdicts`, `mode`, `endpoint_host`, `verdict_timeout_ms`, `rollout_percent`, `enabled_surfaces`, `config_version` |
462| `inference_hooks_signing_secret_generated` | The first save that sets an endpoint generates the signing secret, or an admin rotates it | `action` (`generate_signing_secret`, `rotate_signing_secret`), `changed_fields` (always empty), `enforce_verdicts`, `mode`, `endpoint_host`, `verdict_timeout_ms`, `rollout_percent`, `enabled_surfaces`, `config_version` |
463| `inference_hooks_request_denied` | Your server denied a request | `request_id`, `reference_id`, `source_application`, `session_id`, `model`, `actor_id`, `mode`, `enforced` (`false` in Shadow mode) |
464| `inference_hooks_request_failed_open` | A request proceeded without a verdict: a failed check in Allow or Shadow mode, a Cursor pause, or settings Cursor couldn't load | `request_id`, `reason`, `source_application`, `session_id`, `model`, `actor_id`, `mode`, `status_code` (`0` when no response arrived) |
465| `inference_hooks_request_failed_closed` | A check failed in Block mode, so the request was blocked | `request_id`, `reason`, `source_application`, `session_id`, `model`, `actor_id`, `mode`, `status_code` (`0` when no response arrived) |
466| `inference_hooks_circuit_breaker_tripped` | Sustained failures tripped the circuit breaker | `config_version`, `mode`, `failure_count`, `window_seconds`, `last_failure_kind` |
467
468On `inference_hooks_signing_secret_generated`, the settings fields show the
469state after the change. A rotation bumps `config_version`. A first secret
470shares it with the `inference_hooks_config_updated` event from the same save.
471
472Cursor records request failures in every mode, as failed open in Allow and
473Shadow and failed closed in Block, and it records automatic circuit-breaker
474recovery. `reason` on the failed-open and failed-closed events is a failure
475(`timeout`, `non_200_status`, `unparseable_response`, `oversized_response`,
476`invalid_action`, `transport_error`, `tls_error`, `endpoint_rejected`,
477`frame_too_large`), a Cursor-side cause (`endpoint_not_allowlisted`,
478`config_unavailable`), or, for failed open only, a pause (`kill_switch`). Build
479SIEM rules on these event names and `reason` values.
480
481The `request_id` on denied and failed events matches the frame's `request_id`
482and `webhook-id`, so you can join your vendor's records to the audit log.
483
484The Inference Hooks page also shows endpoint health: status, verdict latency,
485failures per minute, block rate over 24 hours, and recent errors with their
486type and status code. Its figures don't cover all traffic, so they can be lower
487than your vendor's counts.
488
489## Privacy and Privacy Mode
490
491* **Cursor doesn't keep what it sends to your hook.** Cursor sends each frame
492 to your endpoint over HTTPS and discards it once the verdict arrives. Frame
493 content isn't written to Cursor's databases, logs, metrics, or traces.
494* **Your endpoint, your retention.** The endpoint belongs to your organization
495 or your security vendor. What it stores, where, and for how long depends on
496 your configuration and your agreement with that vendor. Cursor doesn't
497 control that data.
498* **Privacy Mode is unchanged.** The model request itself is handled exactly as
499 it is without a hook, under your team's Privacy Mode setting, and the hook
500 adds no copy of it. Inference hooks run for every covered member regardless
501 of Privacy Mode, because your admins direct Cursor to send these requests to
502 your own endpoint.
503* **Frame fields identify people only by opaque IDs.** `actor.email_address` is
504 always null.
505
506Cursor keeps only what it needs to run the feature and show you what happened:
507
508* **Your settings, with secrets encrypted.** Header values and the signing
509 secret are stored encrypted.
510* **Audit log events with identifiers and codes only.** They include your
511 server's `reference_id`, as listed in [Audit log](#audit-log).
512* **Health figures without content.** They hold counts, latencies, and recent
513 error types and status codes.
514* **The block notice, encrypted with the blocked turn.** Your server's
515 `deny_reason` and your Blocked Message are stored, encrypted, with Grok Bot's
516 record of the blocked turn.
517
518## Troubleshooting
519
520### Why don't I see Inference Hooks on the Grok Bot page?
521
522The page appears for team admins on Enterprise teams, and it shows the team
523selected in the dashboard. Check that the right team is selected. If the page
524says "Inference hooks aren't available yet," contact your account manager.
525
526### Why is my endpoint URL rejected?
527
528Check the [endpoint requirements](#endpoint-requirements). The usual causes are
529a port other than 443, a query string or credentials in the URL, a tunnel host,
530or a host that resolves to a private address.
531
532### Why does Test Connection say a signing secret is required?
533
534Cursor generates the secret on the first save that sets an endpoint. Save the
535endpoint, copy the secret into your vendor's console, then test again.
536
537### Why does my server reject Cursor's requests?
538
539Most rejections are a signature or credential mismatch. Paste the current
540signing secret into your server, including the `whsec_` prefix if your verifier
541expects it, and check that it decodes the secret as standard base64. Confirm
542your API key header is saved. If you changed the endpoint URL, re-enter the
543header values. After a rotation, Cursor switches to the new secret within about
544a minute.
545
546### Why does Test Connection return a deny?
547
548Your server's policy denies Cursor's synthetic test prompt. In Allow or Block
549mode, a policy like that blocks members too. Adjust the policy or its default
550action before you turn on enforcement.
551
552### Why are requests timing out?
553
554Your server took longer than the verdict timeout. Check verdict latency in the
555health panel and your vendor's reports. Lighter scan profiles answer faster.
556You can raise **Verdict Timeout (ms)** up to 10,000.
557
558### Why isn't my endpoint receiving requests?
559
560Check that an endpoint is saved, **Enforce Verdicts** is on, **Coverage**
561includes Grok Bot, **Requests Inspected (%)** is above 0, and the circuit
562breaker isn't tripped. Only Grok Bot conversations of your team's members are
563covered. If Test Connection reports that inference hooks are paused, Cursor has
564paused them.
565
566### Why do members see that the policy check is unavailable?
567
568You're in Block mode and the check failed, or the circuit breaker tripped.
569Check **Recent Errors** on the Inference Hooks page. To keep members working
570while you fix the endpoint, switch to **Allow the Request**.
571
572### The circuit breaker tripped. How do I recover?
573
574Fix the endpoint, run Test Connection, then click **Reset**. Automatic recovery
575stops after any settings change, so don't wait for it if you edited anything
576after the trip.
577
578### Why is every message in a conversation blocked after one block?
579
580The blocked message stays in the conversation and goes to your server with
581every later request, so a policy that scans the whole transcript denies each of
582them. Choose **Edit** on the block notice in the desktop or mobile app, or
583**Remove blocked message** on the Bot's reply in Slack, to take the message
584back and send something different. **Reset** clears the conversation instead.
585If the conversation is blocked again right after a reset, what your policy
586matches is likely in the Bot's memory or files. Remove it there. A policy that
587judges the newest user message lets a conversation continue once the member
588sends something different.
589
590### Why don't inference hook events appear in the audit log filter?
591
592The event types appear in the filter only while inference hooks are enabled for
593your team. Events that were recorded still show in the log.
594
595## Related pages
596
597* [Grok Bot security](/grok-bot/security)
598* [Grok Bot for teams and enterprises](/grok-bot/teams-and-enterprises)
599* [Compliance and Monitoring](https://cursor.com/docs/enterprise/compliance-and-monitoring)
600* [Privacy and Data Governance](https://cursor.com/docs/enterprise/privacy-and-data-governance)
