Webhook events and payloads
Webhooks are delivered with a Content-Type
of application/json
, with the event payload as JSON in the request body. We also send the following headers:
X-Snyk-Event
- the name of the eventX-Snyk-Transport-ID
- a GUID to identify this deliveryX-Snyk-Timestamp
- an ISO 8601 timestamp for when the event occurred, for example:2020-09-25T15:27:53Z
X-Hub-Signature
- the HMAC hex digest of the request body, used to secure your webhooks and ensure the request did indeed come from SnykUser-Agent
- identifies the origin of the request, for example:Snyk-Webhooks/XXX
After your server is configured to receive payloads, it listens for any payload sent to the endpoint you configured. For security reasons, you should limit requests to those coming from Snyk.
Event types
While consuming a webhook event, X-Snyk-Event
header must be checked, as an end-point may receive multiple event types.
ping
The ping event happens after a new webhook is created, and can also be manually triggered using the ping webhook API. This is useful to test that your webhook receives data from Snyk correctly.
The ping
event makes the following request:
project_snapshot
This event is triggered every time an existing project is tested and a new snapshot is created. It is triggered on every test of a project, whether or not there are new issues. This event is not triggered when a new project is created or imported. Currently supported targets/scan types are Open Source and container.
Detailed example of a payload
project
see: Projects (v1)
org
see: Organizations (v1)