Notify results
Webhook
5min
Webhook notifiers allow for integrations which subscribe to found secret notifications.
When a new secret is found, an HTTP POST payload will be sent to the webhook’s configured URL. Webhooks can be secured by using a token to generate and verify a signature of the payload.
Key | Description | Required |
|---|---|---|
url | The webhook endpoint to send the notification to | Yes |
token | Token to generate signature for webhook | No |
notifyOnRotation | Set to true to send follow-up webhook notification when secret is rotated | No |
signatureMethod | sha256 or hmac-sha256. Default: sha256 | No |
The signature is sent using in the X-Hub-Signature header. To verify the signature matches the payload, generate a SHA256 hash of the payload body prefixed with the token string.
X-HUB-SIGNATURE:5f246d1f78c832eee4d9b453742476a743a1c7fe73454b6b432b26868525423f
> BODY='{"source_type":"SourceType_SOURCE_TYPE_GIT",...}'
> TOKEN="mySecretToken"
> echo -n "${TOKEN}${BODY}" | sha256sum5f246d1f78c832eee4d9b453742476a743a1c7fe73454b6b432b26868525423f
