Webhooks & Slack

Agency plans can push scan events to your HTTPS endpoint or a Slack incoming webhook.

Setup

Add endpoints in Dashboard → Integrations. The webhook signing secret is shown once when you create an endpoint.

Add a webhook URL (HTTPS required)
Copy the signing secret immediately
Verify X-WPAQ-Signature on every incoming request

Event payload

When a scan finishes, WPAQ POSTs JSON to your URL:

scan.completed

{
  "event": "scan.completed",
  "data": {
    "scan_id": "abc123",
    "hostname": "example.com",
    "status": "completed",
    "overall_score": 91
  },
  "sent_at": "2026-08-31T12:00:00+00:00"
}

Request headers:

X-WPAQ-Event: Event name, e.g. scan.completed
X-WPAQ-Signature: HMAC-SHA256 of the raw request body, prefixed with sha256=

Verify signatures

Reject requests when the signature does not match. Use constant-time comparison in production.

Python

import hmac, hashlib

def verify(body: bytes, secret: str, header: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)

OpenSSL (shell)

# BODY = raw request body bytes
# SECRET = signing secret from Integrations

python3 - <<'PY'
import hmac, hashlib, os
body = os.environ["BODY"].encode()
secret = os.environ["SECRET"].encode()
print("sha256=" + hmac.new(secret, body, hashlib.sha256).hexdigest())
PY

Slack alerts

Paste a Slack incoming webhook URL in Integrations. WPAQ posts a short message when scans complete or when monitored sites change health.

Slack URLs are stored on your account — treat them like passwords.
They are not re-displayed after you save them.
Messages are plain text summaries, not signed payloads.

Open the report

Webhook payloads include scan_id. View the full report at https://wpaq.com/scan/{scan_id} when signed in to the owning account.