Skip to main content

​
Overview

Outbound webhooks send real-time event notifications from Cysmiq to HTTPS endpoints you control.
Availability depends on your Cysmiq plan.
Use outbound webhooks to connect Cysmiq events to internal automation, ticketing workflows, SIEM pipelines, data warehouses, or notification systems.

​
Create an endpoint

Select New Endpoint and configure: After creating an endpoint, copy the Signing Secret immediately. Cysmiq only shows the signing secret when the endpoint is created or when the secret is rotated.

​
Scope

​
Event Subscriptions

Select event labels to control which deliveries Cysmiq sends to an endpoint. Selecting All events covers product events such as scan, repository, and vulnerability events. Use Send Ping from an endpoint’s action menu to send a test Ping delivery directly to that endpoint. Selecting All scan events covers every specific scan event. Selecting All vulnerability events covers every specific vulnerability event. Selecting Vulnerability status changed also matches the more specific vulnerability status events: Vulnerability resolved, Vulnerability closed, Vulnerability reopened, and Vulnerability regression.

​
Endpoint Actions

Open an endpoint to manage it. Endpoint statuses are Active, Paused, and Disabled. Cysmiq can disable an endpoint after repeated delivery failures. A 410 Gone response also disables the endpoint.

​
Signing

Cysmiq signs each webhook delivery with the endpoint signing secret. Store the secret in your receiving system and verify the signature before trusting the payload. The signature header has the format t=<unix_timestamp>,v1=<signature>. During secret rotation overlap, the header can contain two v1 signatures so receivers can accept the previous secret while switching to the new one. To verify a delivery, compute an HMAC SHA-256 over timestamp.delivery_id.attempt_id.raw_json_body with the signing secret, then compare it with a v1 value from X-Cysmiq-Signature.

​
Payload

Webhook payloads use a JSON envelope.

​
Delivery History

Each endpoint shows recent deliveries with:
  • Event
  • Status
  • HTTP
  • Attempts
  • Triggered
Open a delivery to inspect the payload, payload SHA-256, delivery metadata, and individual delivery attempts. Attempts include result, HTTP status, duration, start time, and error details when available. Delivery statuses are:

​
Redelivery

Use Redeliver from a terminal delivery detail view to queue a new delivery with the same payload. Redelivery is available only for terminal deliveries and only when the endpoint is active.