Webhooks
Where a monitoring result goes when nobody is looking at the dashboard.
Setting one up
Monitoring → an asset → webhook URL. Delivery formats are generic JSON, or pre-shaped for Slack, PagerDuty, Datadog, or Splunk, so the receiving system needs no adapter of its own.
Email and webhook delivery are independent. Turning one off does not turn the other off, which is deliberate: the most common alerting failure is assuming a channel is live because a different one is.
What is refused, and why
A webhook destination is rejected if it resolves to a private, loopback, link-local, or carrier-grade NAT address — including the cloud metadata endpoint. The check runs when the URL is saved and again immediately before every delivery.
Checking twice is not redundancy. A hostname that resolved publicly when it was saved can be re-pointed at an internal address later, and a scanner that will fetch a URL on your behalf is exactly the tool an attacker would want for that.
The payload
A delivery describes the change rather than the whole state: which findings are new, which persist, which were fixed, and which regressed since the previous run.
{
"asset": "example.com",
"scanId": "scn_01H...",
"score": 78,
"previousScore": 71,
"findings": { "new": 2, "persisting": 9, "fixed": 4, "regressed": 1 }
}