Integration

Webhook

Every new finding, as JSON, to the endpoint of your choice, with your headers and a signature you verify.

Request a demonstration Try the online demo

What your tool receives

Every new finding can go to this channel according to your alert rules: minimum severity, finding types, specific rules, projects. Only new findings are notified; a known, reopened or resolved finding generates nothing. Messages are written in English. The channel can be tested from the application with a fictitious event.

The message is a JSON POST request carrying the finding type, severity, title, resource, rule key, project and timestamp. With a signing secret, two headers are added, a timestamp and an HMAC-SHA256 signature of the body, to reject what does not come from your instance.

How to connect it

In “Settings”, “Integrations” tab, “Notifications” sub-tab, add the channel with its incoming connector address. Then, in the “Notifications” tab, create an alert rule targeting it. System events (service, scan failure), end-of-scan and assistant summary events only go out if you tick them explicitly.

For a webhook, you provide the address, optional headers and an optional signing secret. A private or internal address is refused.

See it on your accounts

The online demonstration is open to all, on fictitious data. For an instance on your own accounts, request a demonstration.

Request a demonstration Try the online demo