How to receive webhook events

Last updated: September 9, 2026

Instead of asking the API for updates, you can have Strike notify your systems the moment something happens. Webhook subscriptions are managed from Settings → Webhooks.

What you need

  • A URL in your own systems that can receive Strike's events

  • The list of events you want to receive there

  • An API key for your organization, which is what the subscription belongs to

👉 Webhooks are the fastest way to react to a finding: your ticket can be open before anyone logs in.

Events you can subscribe to

  • A run starts and a run finishes. The completion event includes the findings breakdown by severity

  • A run fails

  • Recon finished. The discovered scope is ready for review

  • A threat emulation changes status, from scoping through to completed

  • A summary report is published for a completed run

  • A vulnerability is confirmed. It carries the full finding, so you can open a ticket without asking for anything else

  • A project changes status

👉 Webhook payloads follow the same visibility rules as the platform and the API: your team is never notified about a finding they can't see.

Setting one up

  1. Go to Settings → Webhooks and create a subscription

  2. Enter the URL that will receive the events, and pick the events you want

  3. Copy the signing secret. Like an API key, it's shown only once

  4. Send a test event to confirm your endpoint receives it

👉 Start with the events you'll act on. You can add more later without touching the ones already working.

When a delivery fails

  • Failed deliveries are retried automatically, with growing intervals, for about an hour

  • After ten consecutive failures the subscription is disabled and the key owner is notified by email

  • Re-enable it from Settings → Webhooks once your endpoint is healthy again

👉 The delivery activity log shows recent attempts and their result, the place to start when an event you expected never arrived.

Security

  • Every delivery is signed, so your team can verify it came from Strike before acting on it

  • The signing secret can be rotated at any time from the subscription

  • Each delivery carries a unique identifier, so a retry is never processed twice