Docs

Webhooks

scan.completed, scan.failed, credit.low - HMAC signed.

Google

All docs Start free

01 · Draft

Human or LLM

Paste, PR, webhook, or CLI. The gate does not care who wrote it.

← Docs

Get notified the moment a scan finishes. HMAC-signed, idempotent, with retries.

Configuration

Add webhooks at /account/webhooks. Each webhook has a URL, an event list, and an auto-generated signing secret.

Events

scan.completed
Scan finished (BLOCKER, FAIL, WARNING, OPTIMIZATION, or PASS). Includes score + verdict.
scan.failed
Scan errored out (network, parse error, etc).
scan.auto_fixed
One-click auto-fix rewrote a failed check.
credit.low
Balance dropped below 10% of monthly allocation.
credit.exhausted
Balance reached 0. Next scan will return 402.

Payload format

Every event is POSTed as JSON with an HMAC-SHA256 signature in X-Dokeo-Signature.

POST /your-endpoint
Content-Type: application/json
X-Dokeo-Signature: sha256=abc123...
X-Dokeo-Event: scan.completed
X-Dokeo-Delivery: evt_8f2k...

{
  "event": "scan.completed",
  "id": "evt_8f2k...",
  "created_at": "2026-06-28T10:00:00Z",
  "data": {
    "scan_id": 1234,
    "tenant": "shaikhrasul02",
    "url": "https://example.com/post",
    "verdict": "PASS",
    "score": 87,
    "credits_used": 1
  }
}

Verifying signatures

In your handler:

import hmac, hashlib

def verify(secret: str, header: str, body: bytes) -> bool:
    # header = "sha256=abc123..."
    expected = "sha256=" + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, header)