Webhook Integration

Overview #

DryRun Security sends a webhook POST request to a configured endpoint when a finding is detected on a pull request. Use this to route finding data to custom dashboards, ticketing systems, SIEMs, or automation tools.

Webhook setup is a two-step process: first create the webhook in Integrations, then attach it to a configuration to activate it for specific repositories.

Step 1: Create a Webhook #

1. In the left nav of the DryRun Security dashboard, click Integrations.
2. Find the Generic Webhook entry and click Details.
3. Click Add Webhook +.
4. Enter a Name for the webhook.
5. Enter the Webhook URL of your endpoint.
6. Select a Risk Level. Findings at the selected severity and above will trigger the webhook.

Risk Level	Findings included
All	All findings regardless of severity
Medium	Medium, High, and Critical
High	High and Critical
Critical	Critical only

7. Use the Enabled toggle to activate or pause the webhook at any time.
8. Check Global to trigger this webhook for all repositories, regardless of configuration. Leave it unchecked to activate it only through specific configurations (see Step 2).
9. Click Save.

Step 2: Activate for Repositories #

A webhook only fires for repositories included in a configuration with notifications enabled. To attach your webhook to a configuration:

1. Navigate to Configurations in the dashboard.
2. Click Edit on an existing configuration.
3. Toggle Notifications Enabled on.
4. In the Select Integrations dropdown, choose the webhook you created in Step 1.
5. Click Save at the bottom of the page.

The webhook will now fire for any PR finding in the repositories covered by that configuration.

If you have not created a webhook yet, click Add + on the Configurations page to go directly to the Generic Webhook setup page.

Payload Format #

DryRun Security sends an HTTP POST with a JSON body to your endpoint when a scan completes. The body includes PR context, scan metadata, and the full list of findings.

{
    "dashboard_url": "https://app.dryrun.security/pull-requests/00000000-0000-0000-0000-000000000000",
    "github_url": "https://github.com/org/repo/pull/123",
    "risk_threshold": "high",
    "org": "your-org",
    "repo_name": "your-repo",
    "repo_full_name": "your-org/your-repo",
    "pr_number": 123,
    "pr_title": "Add payment endpoint",
    "pr_status": "open",
    "branch": "feature/payments",
    "commit_author": "developer",
    "issue_status": "open",
    "run_time": "2026-06-09T16:48:44.960558Z",
    "results": [
        {
            "id": "00000000-0000-0000-0000-000000000001",
            "finding_type": "pullrequest",
            "type": "Missing Authorization on Payment Endpoint",
            "filename": "src/payments/handler.py",
            "line_start": 42,
            "line_end": 58,
            "description": "The POST /payments endpoint does not verify the caller's identity...",
            "risk": "high"
        }
    ]
}

Top-level fields #

Field	Type	Description
dashboard_url	string	Link to the PR in the DryRun Security dashboard
github_url	string	Link to the pull request in your SCM
risk_threshold	string	Highest risk level among all findings in this scan: critical, high, medium, or low. Returns passing when no findings meet the configured Risk Level threshold.
org	string	Organization name
repo_name	string	Repository name
repo_full_name	string	Full repository identifier in org/repo format
pr_number	integer	Pull request number
pr_title	string	Pull request title
pr_status	string	Pull request status: open or closed
branch	string	Branch the pull request was opened from
commit_author	string	Author of the triggering commit
issue_status	string	Whether any open findings remain: open or resolved
run_time	string (date-time)	Timestamp of when the scan completed
results	array	List of findings from this scan. Empty when no findings meet the configured Risk Level.

Result fields #

Field	Type	Description
id	string (uuid)	Unique finding ID
finding_type	string	Source of the finding: pullrequest, code_policy, deepscan, or sca
type	string	Finding name
filename	string	File where the finding was detected
line_start	integer	Starting line of the affected code
line_end	integer	Ending line of the affected code
description	string	Full finding description
risk	string	Risk level of this finding: critical, high, medium, or low