API documentation

Custom webhook

Leak events are sent to your own system as signed JSON.

How it works

Anywhere without a ready-made integration connects through this: your own application, an automation tool or an internal service. A delivery counts as successful when the endpoint returns 2xx; any other response is retried.

Every request carries an X-DarkRadar-Signature header: a timestamp and an HMAC-SHA256 signature of the raw body. The receiver signs the body before parsing it, compares in constant time and rejects old timestamps.

Every request has a delivery identifier. The same event can arrive more than once after a network error; the receiver stores that identifier and drops repeats.

Limits

The address must be https; internal network addresses are refused.
The body does not contain the leak itself: the event type, severity, affected party and panel link go out.
Nothing is read from your system.

Setup

The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.

Was this page helpful?