Webhooks - Snapsec Suite

Subscribe external services to Snapsec events using real-time HTTP webhooks.

Webhook Security

All webhook payloads include an X-Snapsec-Signature header computed using HMAC-SHA256 with your shared webhook secret:

import hmac, hashlib

expected_sig = hmac.new(
    webhook_secret.encode(),
    payload_body.encode(),
    hashlib.sha256
).hexdigest()

assert request.headers["X-Snapsec-Signature"] == f"sha256={expected_sig}"

Supported Events

finding.created: New vulnerability detected.
finding.status_changed: Status updated (e.g., Active -> Resolved).
assessment.started / assessment.completed: Pentest or scan run lifecycle.
sla.warning / sla.breached: SLA deadline alerts.