Policies and webhooks

Added in v0.3.0

Policies

Policies automate responses to findings based on conditions.

Structure

A policy consists of:

• Scope - application, group, or global
• Event types - triggers that activate the policy
• Conditions - filters (severity, scanner, risk score, etc.)
• Actions - what to do when triggered

POST /api/policies
Content-Type: application/json

{
  "name": "Auto-assign critical findings",
  "scope_type": "global",
  "event_types": ["finding.created"],
  "conditions": [
    {
      "field": "severity",
      "op": "in",
      "value": ["critical", "high"]
    }
  ],
  "actions": [
    {
      "type": "assign_to",
      "target": "1"
    }
  ]
}

Conditions

Operator	Description
in	Value is in a list
not_in	Value is not in a list
eq	Equals
neq	Not equals
gte	Greater than or equal
lte	Less than or equal
regex	Matches regular expression

Available condition fields: severity, risk_score, scanner_type, status, cwe_id, file_path.

Available actions

Action	Description
change_status	Automatically transition finding status (target: open, confirmed, false_positive, fixed)
assign_to	Assign finding to a user (target: user ID)
webhook	Fire a webhook with finding data

Webhooks

Webhooks send HTTP callbacks when events occur.

POST /api/applications/{id}/webhooks
Content-Type: application/json

{
  "url": "https://hooks.example.com/security",
  "events": "finding.created",
  "secret": "optional-hmac-secret"
}

Supported events

Event	Description
finding.created	A new finding was ingested
finding.status_changed	Finding status changed
finding.reassigned	Finding reassigned
scan.completed	A scan finished processing

Webhook payloads are signed with HMAC-SHA256 when a secret is configured (header: X-Servasec-Signature).