Webhooks & Slack

1. Add a webhook URL (HTTPS required)
2. Copy the signing secret immediately
3. Verify X-WPAQ-Signature on every incoming request

When a Site Audit finishes, WPAQ POSTs JSON to your URL. scan.completed is currently the only event — Conversion Audit and Content Quality Audit don't fire webhooks yet, and every endpoint subscribes to it by default.

{
  "event": "scan.completed",
  "data": {
    "scan_id": "abc123",
    "hostname": "example.com",
    "overall_score": 91,
    "report_url": "https://wpaq.com/site-audit/abc123"
  },
  "sent_at": "2026-08-31T12:00:00+00:00"
}

Request headers:

X-WPAQ-Event

Event name, e.g. scan.completed

X-WPAQ-Signature

HMAC-SHA256 of the raw request body, prefixed with sha256=

Delivery is best-effort, not at-least-once: each event is sent once with an 8-second timeout and no automatic retry. If your endpoint is down or slow, that delivery is lost — poll GET /api/v1/site-audits/{id} from the REST API as a reconciliation fallback for anything you can't afford to miss. Endpoints must resolve to a public HTTPS host — requests to private/internal addresses are blocked before they're sent.

Reject requests when the signature does not match. Use constant-time comparison in production.

import hmac, hashlib

def verify(body: bytes, secret: str, header: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)

# BODY = raw request body bytes
# SECRET = signing secret from Integrations

python3 - <<'PY'
import hmac, hashlib, os
body = os.environ["BODY"].encode()
secret = os.environ["SECRET"].encode()
print("sha256=" + hmac.new(secret, body, hashlib.sha256).hexdigest())
PY

Paste a Slack incoming webhook URL in Integrations. WPAQ posts a short message when Site Audits complete or when monitored sites change health.

• Slack URLs are stored on your account — treat them like passwords.
• They are not re-displayed after you save them.
• Remove a connection anytime from Dashboard → Integrations.
• Messages are plain text summaries, not signed payloads.

Each payload includes report_url — a direct link to the Site Audit report. Recipients need to be signed in to the owning account unless you have shared the report separately with a share link (Business and Agency).