Outbound webhooks
BattleTest sends signed webhook payloads to any HTTP endpoint you configure when findings are created or scan runs complete. Webhooks are the primary way to push BattleTest data into your own systems — Slack alerts, PagerDuty incidents, ticketing systems, SIEMs, custom dashboards. Available on: Dev plan and higher.- To wire one up: How to send findings to external tools
- Payload schema, events, signatures, retries: Outbound Webhooks reference
GitHub status check
Every PR review sets abattletest/security-review commit status check on the PR. Use it as a required check in GitHub branch protection rules to block merges until the security review has completed.
The check reports success when the risk score is below 40, action_required at 40 or higher (“request changes”), and failure only on an internal review error. On its own it blocks nothing; add it as a required status check to gate merges on risky PRs. See How to require security review before merging for setup. No CI config, no runner minutes, no GitHub Actions dependency.
REST API — coming soon
A REST API is in development and will support:- Triggering PR and live scan runs programmatically
- Querying findings, scan history, and risk score trends
- Managing targets, repository connections, and settings
- Bulk export of finding data