Webhooks

Webhooks push an HTTP POST to a URL you control whenever something happens to a vulnerability report in your organization: created, updated, triaged, and so on. Use them to sync reports into your own tracker, notify a channel, or trigger automation.

Set up in the app

In the app, open Webhooks and add one with:

a name,
the URL to deliver to, and
the events you want to receive (checkboxes).

Events

You can subscribe to any of these vulnerability events:

Event	Fires when
`Vuln::Created`	A report is created.
`Vuln::Updated`	A report is updated.
`Vuln::Read`	A report is read.
`Vuln::Destroyed`	A report is deleted.
`Vuln::Inbox::Received`	A report lands in the inbox.
`Vuln::Inbox::Stored`	An inbox report is stored.
`Vuln::Processing::Closed`	A report is closed.
`Vuln::Processing::Reopened`	A closed report is reopened.

Discover events via the API

Event types have stable ids you attach when subscribing. List them:

curl https://api.disclosebot.io/v1/webhook_event_types \
  -H "Authorization: Bearer disclosebot_svc_xxxxxxxx" \
  -H "Accept: application/vnd.api+json"

Each item has a name (e.g. Events::Vuln::Created) and a short_name (Vuln::Created).

Manage via the API

Webhooks are a full CRUD resource (GET/POST/PATCH/DELETE /v1/webhooks). Subscribe by attaching a trigger_event_types relationship, referencing ids from the discovery endpoint:

curl -X POST https://api.disclosebot.io/v1/webhooks \
  -H "Authorization: Bearer disclosebot_svc_xxxxxxxx" \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "webhook",
      "attributes": { "name": "My integration", "url": "https://example.com/hooks", "enabled": true },
      "relationships": {
        "trigger_event_types": {
          "data": [
            { "type": "trigger_event_type", "id": "<created-id>" },
            { "type": "trigger_event_type", "id": "<closed-id>" }
          ]
        }
      }
    }
  }'

See the Platform API reference for the full webhook and event-type schemas.

Delivery

When a subscribed event fires, we POST a JSON body to your URL with headers Content-Type: application/json and User-Agent: disclosebot/1.0. The payload wraps the affected report:

{
  "vuln": {
    "id": "…",
    "shortcode": "…",
    "title": "…",
    "description": "…",
    "inbox_state": "…",
    "processing_state": "…",
    "organization_id": "…",
    "tags": [],
    "assets": [{ "id": "…", "kind": "domain", "value": "example.com" }],
    "created_at": "2026-01-01T00:00:00Z",
    "updated_at": "2026-01-01T00:00:00Z"
  }
}

A Vuln::Destroyed event sends a minimal { "vuln": { "id": "…", "destroyed": true } }.