Configuring Webhooks
A webhook sends a message to another system when an event occurs in CVD Portal. Webhooks need the Enterprise plan.
Add a webhook in the dashboard
- Go to Settings → Integrations.
- Select the type: Slack, Microsoft Teams, Discord or Generic (any HTTPS URL).
- Enter the URL. For Slack, Teams and Discord, the URL must use the host of that service.
- Select one event.
- Optional: for a Generic webhook, enter a secret.
- Save, then click Test to send a test message.
Each webhook sends one event. To send more events to the same URL, add one webhook for each event.
Because the webhook URL contains the token that posts to your channel, only admins see the full URL and other roles see the host only, for example https://hooks.slack.com/••••.
Events you can select in the dashboard
| Event | When it occurs |
|---|---|
submission.created | A new report arrives through the public portal, the bulk submission API, POST /api/v1/vulnerabilities or the MCP tool submit_vulnerability. A report that a team member creates in the dashboard sends no event. |
sla.breached | A report passed its resolution SLA. Resolution SLAs need the Enterprise plan. |
sla.deadline_approaching | A recurring security review is near its due date or overdue. The dashboard label is "Security review due". |
art14.deadline_approaching | An Article 14 deadline is near |
art14.deadline_breached | An Article 14 deadline has passed |
threat_intel.match | A new vulnerability matches a component in your SBOM |
sbom.ingested | An SBOM arrives through the API |
exploitation.detected | Public sources show exploitation of a CVE in one of your advisories |
advisory.published | You publish an advisory |
product.classified | A product classification changes |
submission.triage_failed | AI triage fails for a report |
partner.drillin_started | A partner opens your workspace. The access field is read-only for Look and write for Work in |
Register a webhook with the API
POST /api/v1/webhooks/register creates a Generic webhook. The API key needs the webhooks:write scope. The body has url (HTTPS), event (default submission.created) and an optional secret of 32 or more characters.
The approval.requested event (an AI agent asks for approval of an action) can only be selected through this API.
Payload and signature
A Generic webhook receives a JSON body with the event name and the event data. When the webhook has a secret, CVD Portal signs the body with HMAC SHA-256 and sends the signature in the X-CVD-Signature and X-CVD-Signature-256 headers.
Slack, Teams and Discord webhooks receive a message in the format of that service.
A threat_intel.match payload for a finding in an older release that is still in the field also has a release object with id, version, productId and productName. A finding in the current SBOM has no release field.
Limits
CVD Portal does not show a delivery history or delivery success rates for webhooks.