Webhooks

ReferencePublicUpdated 2026-04-08

Webhooks

SmoothGlue can POST events to external URLs when platform events occur. Webhooks are configured in the Console under Settings → Webhooks.

Event types

Event	Trigger
deployment.synced	ArgoCD sync completed successfully
deployment.failed	ArgoCD sync failed
compliance.drift_detected	Platform Custodian detected a compliance drift
compliance.remediated	Platform Custodian auto-remediated a drift
user.created	New user added to the platform
platform.tool_unhealthy	A platform tool entered an unhealthy state
sbom.generated	A new SBOM was attached to an image

Webhook payload format

All events share a common envelope:

{
  "event": "deployment.synced",
  "timestamp": "2026-04-08T14:30:00Z",
  "platform_id": "my-smoothglue",
  "data": {
    // event-specific fields
  }
}

deployment.synced payload

{
  "event": "deployment.synced",
  "timestamp": "2026-04-08T14:30:00Z",
  "platform_id": "my-smoothglue",
  "data": {
    "deployment_id": "deploy-xyz789",
    "app_name": "my-app",
    "namespace": "my-app",
    "image": "registry1.dso.mil/my-app:v1.2.3",
    "revision": "a3f8b2c"
  }
}

compliance.drift_detected payload

{
  "event": "compliance.drift_detected",
  "timestamp": "2026-04-08T03:15:00Z",
  "platform_id": "my-smoothglue",
  "data": {
    "control": "STIG-K8s-V-242383",
    "description": "Kubernetes API server audit logging disabled",
    "severity": "high",
    "auto_remediating": true
  }
}

Webhook security

Requests include an X-SmoothGlue-Signature header: HMAC-SHA256 of the request body using your webhook secret. Verify this signature before processing events.

import hmac, hashlib

def verify_signature(payload_bytes, signature_header, secret):
    expected = hmac.new(secret.encode(), payload_bytes, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header)