API · 1 of 4

Webhook events.

Scovant supports two kinds of webhooks, both on any paid plan (Monitor, Team, Business, Enterprise): outgoing — Scovant pushes CI results and regression alerts to your endpoint — and incoming — your deploy pipeline calls Scovant to trigger a CI run.

Outgoing webhooks

Create an outgoing webhook:

POST /api/webhooks
{ "workspace_id": "<uuid>", "type": "outgoing", "target_url": "https://yourapp.com/hook" }

The response includes a secret, shown once — store it to verify deliveries.

`ci.completed`

Fires on every CI run completion once a baseline exists for the environment — zero-regression passes included — so the empty-silence ambiguity is gone: subscribe to this event and treat regressions_count: 0 as your green build.

json

{
  "event": "ci.completed",
  "workspace_id": "<uuid>",
  "site_id": "<uuid>",
  "source_type": "scan",
  "current_run_id": "<uuid>",
  "baseline_run_id": "<uuid or null>",
  "environment": "production",
  "branch": "main",
  "commit_sha": "<sha or null>",
  "status": "completed",
  "regressions_count": 0,
  "compared": true,
  "security_diff": null,
  "attribution": {"attribution": "SITE_DELTA", "control_quality": "PARTIAL", "changed_dimensions": [], "unknown_dimensions": ["POLICY"]},
  "scoring_model_changed": false,
  "baseline_scoring_model": "<ruleset>",
  "current_scoring_model": "<ruleset>",
  "skipped_reason": null,
  "timestamp": "2026-07-15T12:00:00+00:00"
}

status is the run's terminal status (completed, partial, or failed); compared is false when no baseline comparison actually ran (e.g. the recorded baseline run was since deleted). One delivery per completed run (source_type scan or simulation); redeliveries are deduplicated for 24 hours. Two cases emit nothing: the first run for an environment (it establishes the baseline — there is no comparison to report) and runs that never finish (swept as stuck).

security_diff is the security-regression outcome summary or null when not computed. attribution (attribution, control_quality, changed_dimensions, unknown_dimensions) says whether the two compared runs differed in scoring model or scanner build rather than in the site itself, or null when the delta couldn't be attributed. scoring_model_changed / baseline_scoring_model / current_scoring_model flag when the two runs used a different ruleset_version, so a score delta isn't mistaken for a site change. skipped_reason explains why an otherwise-eligible run was not compared against its baseline.

`regressions.detected`

Still fires only when regressions were found — one POST per CI run that detected regressions, with the run's regressions batched into a single payload:

json

{
  "event": "regressions.detected",
  "workspace_id": "<uuid>",
  "site_id": "<uuid>",
  "source_type": "scan",
  "current_run_id": "<uuid>",
  "baseline_run_id": "<uuid>",
  "environment": "production",
  "branch": "main",
  "commit_sha": "<sha>",
  "regressions": [
    { "id": "<uuid>", "type": "score_drop", "severity": "high", "summary": "..." }
  ],
  "timestamp": "2026-07-15T12:00:00+00:00"
}

A clean run sends ci.completed with regressions_count: 0 instead — for a poll-based verdict, use the MCP list_regressions tool (see GitHub Actions).

Each delivery — both events — includes an X-Scovant-Signature: sha256=<hex> header, where <hex> is the HMAC-SHA256 of the raw request body keyed by your webhook secret. Recompute it over the received bytes and compare before trusting the payload.

Incoming webhooks

An incoming webhook lets a deploy pipeline trigger a CI run without holding an API token. Create one with "type": "incoming" (workspace owner only), then call:

POST /api/ci/webhook/{webhook_id}
X-Scovant-Secret: <your webhook secret>

with the same request body and 202 response as POST /api/ci/trigger.

Webhook secrets use secrets.token_urlsafe(32) format (not the scvt_ prefix, which is for API tokens).

Regression types

Regressions persist under six general types — score_drop, category_degradation and new_critical_issue for scans; simulation_failure, earlier_step_failure and slow_simulation for simulations — plus two families read from the versioned MCP-interface and security snapshots: MCP-REG-001..005,007 (interface diff; 002 tool removed and 007 server identity changed notify, the rest are recorded silently) and SEC-REG-001..008 (security regressions; 007 is recorded silently). Silent codes are visible via GET /api/regressions and the MCP list_regressions tool but send no e-mail/Slack/regressions.detected.

Silent codes still count toward ci.completed's regressions_count and appear in list_regressions, so regressions_count: 0 is always green but a non-zero count is not by itself a failure. To gate a build, fail on regressions.detected, or filter the regressions by regression_type and ignore the silent codes above.