Webhook

The Webhook integration sends HTTP POST requests to your API endpoints when StackHawk events occur. Use webhooks to connect StackHawk with internal tools, custom dashboards, or any service that accepts HTTP callbacks.

Overview

Configure webhooks to receive notifications for any of these events:

Scan Events

Event	Description
Scan Started	Fires when a scan begins
Scan Completed	Fires when a scan finishes successfully, includes findings data
Scan Errored	Fires when a scan encounters an error

Audit Log Events

Event	Description
User Activity	Fires on user actions within your organization, such as inviting users, adding API keys, modifying integrations, and more
Organization Activity	Fires on organization-level events such as triaged alerts sent to third parties

Each webhook request includes a JSON payload with event details. You can configure custom authentication headers, filter by specific event types, and test webhooks before enabling them for production use.

Requirements

• A StackHawk account
• A plan with the Webhook Integration enabled. Contact StackHawk Support to enable it.

Setup

1. Log into StackHawk and navigate to the Webhook Integration page.
2. Click Add Webhook. In the panel that opens, configure:
   • Name and Description
   • Scan Data For — select target application(s) or “All Applications”
   • Events — select which events trigger the webhook (e.g. Scan Started, Scan Completed, Scan Errored, User Activity, Organization Activity)
   • User Activity Types — optionally filter which user activities to receive (leave empty for all)
   • Organization Activity Types — optionally filter which organization activities to receive (leave empty for all)
   • Auth Header Name and Auth Header Value — optional authentication headers
   • Webhook Endpoint URL — your HTTPS endpoint
3. Click Save. StackHawk sends a test payload and displays the response. Use Test to send additional test requests for debugging.
4. Toggle the webhook to Enabled to start receiving live events.

Allowed IP Addresses

• 44.227.38.189
• 54.69.98.33
• 44.227.81.160

Webhook Management

Click the … menu on any webhook to access management options:

Action	Description
Edit	Modify webhook settings, endpoint, or event triggers
Enable/Disable	Toggle whether the webhook receives live events
Delete	Remove the webhook permanently

Payload

Enabled webhooks receive a JSON payload via HTTP POST for each triggered event. If you configured authentication headers, they are included in the request.

Scan Completed

The Scan Completed payload includes:

• Scan metadata (ID, application, environment, timestamps)
• Findings with vulnerability details and affected paths
• CompletedScanStats summary of findings by severity and triage status

Example payload:

{
  "service": "StackHawk",
  "scanCompleted": {
    "scan": {
      "id": "21a4f2da-740b-40d9-9557-696d8aca6a76",
      "hawkscanVersion": "4.0.0",
      "env": "Development",
      "status": "COMPLETED",
      "application": "Contosso",
      "startedTimestamp": "2021-05-18T00:26:41.892Z",
      "scanURL": "https://app.stackhawk.com/scans/21a4f2da-740b-40d9-9557-696d8aca6a76",
      "tags": [
        {
          "name": "category",
          "value": "${CATEGORY_FROM_ENV:default}"
        }
      ]
    },
    "scanDuration": "1",
    "spiderDuration": "33",
    "completedScanStats": {
      "urlsCount": "5",
      "duration": "34",
      "scanResultsStats": {
        "totalCount": "3",
        "lowCount": "2",
        "mediumCount": "0",
        "highCount": "0",
        "lowTriagedCount": "0",
        "mediumTriagedCount": "1",
        "highTriagedCount": "0"
      }
    },
    "findings": [
      {
        "pluginId": "10106",
        "pluginName": "HTTP Only Site",
        "severity": "Medium"