How to receive webhook events

Last updated: October 20, 2026

Instead of polling the API for updates, you can have Strike notify your systems the moment something happens. Webhook subscriptions are managed from Settings → Webhooks.

What you need

  • A URL in your own systems that can receive Strike events.

  • The list of events you want to receive there.

  • An API key for your organization, which is who the subscription belongs to. For more details, see How to create and manage API keys.

Webhooks are the fastest way to react to a finding: your ticket can be open before anyone logs in to the platform.

Events you can subscribe to

  • A run starts and a run finishes. The completion event includes the breakdown of findings by severity.

  • A run fails.

  • A Threat Emulation changes status.

  • The summary is published for a completed run.

  • A vulnerability is confirmed. It includes the full finding, so you can open a ticket without requesting anything else.

  • A Project changes status.

Webhook payloads follow the same visibility rules as the platform and the API: your team never receives a notification about a finding it cannot see.

How to set one up

  1. Go to Settings → Webhooks and create a subscription.

  2. Enter the URL that will receive the events and choose the events you want.

  3. Copy the signing secret. Like an API key, it is shown only once.

  4. Send a test event to confirm that your endpoint receives it.

Start with the events you will act on. You can add more later without touching the ones that already work.

When a delivery fails

  • Failed deliveries are retried automatically, at increasing intervals, for about an hour.

  • After ten consecutive failures, the subscription is disabled and the Owner is notified by email.

  • Re-enable it from Settings → Webhooks once your endpoint is working.

The delivery activity log shows the latest attempts and their result. It is the place to start when an event you were expecting never arrived.

Security

  • Every delivery is signed, so your team can verify that it came from Strike before acting on it.

  • The signing secret can be rotated at any time from the subscription.

  • Every delivery includes a unique identifier, so a retry is never processed twice.