Configuring Webhooks
A webhook sends a message to another system when an event occurs in CVD Portal. Webhooks need the Enterprise plan.
Add a webhook in the dashboard
- Go to Settings → Integrations.
- Select the type: Slack, Microsoft Teams, Discord or Generic (any HTTPS URL).
- Enter the URL. For Slack, Teams and Discord, the URL must use the host of that service.
- Select one event.
- Optional: for a Generic webhook, enter a secret.
- Save, then click Test to send a test message.
Each webhook sends one event. To send more events to the same URL, add one webhook for each event.
Events you can select in the dashboard
| Event | When it occurs |
|---|---|
submission.created | A new report arrives |
sla.breached | A report passed its resolution SLA. Resolution SLAs need the Enterprise plan. |
sla.deadline_approaching | A recurring security review is near its due date or overdue. The dashboard label is "Security review due". |
art14.deadline_approaching | An Article 14 deadline is near |
art14.deadline_breached | An Article 14 deadline has passed |
threat_intel.match | A new vulnerability matches a component in your SBOM |
sbom.ingested | An SBOM arrives through the API |
exploitation.detected | Public sources show exploitation of a CVE in one of your advisories |
advisory.published | You publish an advisory |
product.classified | A product classification changes |
submission.triage_failed | AI triage fails for a report |
partner.drillin_started | A partner opens your workspace |
Register a webhook with the API
POST /api/v1/webhooks/register creates a Generic webhook. The API key needs the webhooks:write scope. The body has url (HTTPS), event (default submission.created) and an optional secret of 32 or more characters.
The approval.requested event (an AI agent asks for approval of an action) can only be selected through this API.
Payload and signature
A Generic webhook receives a JSON body with the event name and the event data. When the webhook has a secret, CVD Portal signs the body with HMAC SHA-256 and sends the signature in the X-CVD-Signature and X-CVD-Signature-256 headers.
Slack, Teams and Discord webhooks receive a message in the format of that service.
Limits
CVD Portal does not show a delivery history or delivery success rates for webhooks.