How to send findings to external tools

Dev plan or higher. Outbound webhooks are not available on the Free plan. View plans →

BattleTest sends signed webhook events when findings are created and when scan runs complete. Use them to push security data into the tools your team already watches. For the full payload schema, event list, and retry behaviour, see the Outbound Webhooks reference.

Create a webhook

Open Webhooks settings

Go to Settings → Webhooks and click Add webhook.

Enter your endpoint URL

Paste the HTTPS URL that should receive events — your server, a Slack incoming webhook proxy, or a workflow automation endpoint.

Copy the signing secret

BattleTest shows a signing secret once, on creation. Store it in your secrets manager — you’ll need it to verify signatures.

Save and test

Save the webhook. Use the Send test event button to confirm your endpoint receives and acknowledges the payload with a 2xx response.

Alert on confirmed critical findings

Listen for battletest.vulnerability events, which fire only on confirmed CRITICAL or HIGH live-scan findings, and route them to a paging or chat channel.

app.post('/battletest-webhook', (req, res) => {
  // verify the signature first — see the webhooks reference
  const { event, data } = req.body
  if (event === 'battletest.vulnerability' && data.finding.severity === 'critical') {
    notifyPagerDuty(`Critical: ${data.finding.title} on ${data.domain}`)
  }
  res.sendStatus(200)
})

Auto-create tickets for new findings

On pr_review.completed, parse the findings and open a ticket for any HIGH or CRITICAL finding that isn’t already tracked. The run_id in the payload links back to the full finding detail in the dashboard.

Track posture over time

On every battletest.completed, write the risk score and finding counts to your analytics store, then plot the trend in Grafana or Datadog alongside your other engineering metrics.

Always verify the x-battletest-signature header before acting on a payload. See Signature verification for the HMAC check.

Get started

Guides

Plans & API

How to send findings to external tools

Create a webhook

Alert on confirmed critical findings

Auto-create tickets for new findings

Track posture over time

​Create a webhook

​Alert on confirmed critical findings

​Auto-create tickets for new findings

​Track posture over time

Create a webhook

Alert on confirmed critical findings

Auto-create tickets for new findings

Track posture over time