Docs · v1.4

Build with Scovant.

Run scans, simulations, and showcase from the dashboard — or drive it all from your pipeline: the REST API, CI/CD trigger, webhooks, and the MCP interface are live today. Entries marked “Soon” are on the roadmap.

API · 1 of 2

Webhook events.

Scovant supports two kinds of webhooks, both on the Monitor or Enterprise plan: outgoing — Scovant pushes CI results and regression alerts to your endpoint — and incoming — your deploy pipeline calls Scovant to trigger a CI run.

Outgoing webhooks

Create an outgoing webhook:

POST /api/webhooks
{ "workspace_id": "<uuid>", "type": "outgoing", "target_url": "https://yourapp.com/hook" }

The response includes a secret, shown once — store it to verify deliveries.

ci.completed

Fires on every CI run completion once a baseline exists for the environment — zero-regression passes included — so the empty-silence ambiguity is gone: subscribe to this event and treat regressions_count: 0 as your green build.

json
{
  "event": "ci.completed",
  "workspace_id": "<uuid>",
  "site_id": "<uuid>",
  "source_type": "scan",
  "current_run_id": "<uuid>",
  "baseline_run_id": "<uuid or null>",
  "environment": "production",
  "branch": "main",
  "commit_sha": "<sha or null>",
  "status": "completed",
  "regressions_count": 0,
  "compared": true,
  "timestamp": "2026-07-15T12:00:00+00:00"
}

status is the run's terminal status (completed, partial, or failed); compared is false when no baseline comparison actually ran (e.g. the recorded baseline run was since deleted). One delivery per completed run (source_type scan or simulation); redeliveries are deduplicated for 24 hours. Two cases emit nothing: the first run for an environment (it establishes the baseline — there is no comparison to report) and runs that never finish (swept as stuck).

regressions.detected

Still fires only when regressions were found — one POST per CI run that detected regressions, with the run's regressions batched into a single payload:

json
{
  "event": "regressions.detected",
  "workspace_id": "<uuid>",
  "site_id": "<uuid>",
  "source_type": "scan",
  "current_run_id": "<uuid>",
  "baseline_run_id": "<uuid>",
  "environment": "production",
  "branch": "main",
  "commit_sha": "<sha>",
  "regressions": [
    { "id": "<uuid>", "type": "score_drop", "severity": "high", "summary": "..." }
  ],
  "timestamp": "2026-07-15T12:00:00+00:00"
}

A clean run sends ci.completed with regressions_count: 0 instead — for a poll-based verdict, use the MCP list_regressions tool (see GitHub Actions).

Each delivery — both events — includes an X-Scovant-Signature: sha256=<hex> header, where <hex> is the HMAC-SHA256 of the raw request body keyed by your webhook secret. Recompute it over the received bytes and compare before trusting the payload.

Incoming webhooks

An incoming webhook lets a deploy pipeline trigger a CI run without holding an API token. Create one with "type": "incoming" (workspace owner only), then call:

POST /api/ci/webhook/{webhook_id}
X-Scovant-Secret: <your webhook secret>

with the same request body and 202 response as POST /api/ci/trigger.

Webhook secrets use secrets.token_urlsafe(32) format (not the scvt_ prefix, which is for API tokens).