Skip to main content
Use a Snyk webhook to send vulnerabilities found in project scans to Flashduty On-call. Snyk sends one project_snapshot/v0 event every time it retests a project: each issue in newIssues opens a Flashduty alert, and each issue in removedIssues recovers its alert. Snyk webhooks currently cover Open Source and Container scans. The Webhooks API is in beta and is available only in the Snyk US-01, US-02, EU-01, and AU-01 regions.

In Flashduty On-call

You can get the integration push URL in either of the following ways.

Use a dedicated integration

  1. Open the Flashduty console, choose Channels, and open a channel
  2. Choose Settings → Integrations → Dedicated integrations, then click Add integration
  3. Choose Snyk and click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. Open the Flashduty console and choose Integration Center → Alert events
  2. Choose Snyk and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

In Snyk

Snyk webhooks can only be created through the API; the Snyk web console has no entry for them.
1

Prepare Snyk credentials and check the plan

Where: Snyk console › Settings › Billing › Available plans (only if you need to start the trial or upgrade)The organization’s plan must include API access. On the Free plan the Webhooks API fails with The org <name> (<id>) is not entitled for api access. Please upgrade your plan. Start the free 14-day trial under Settings → Billing → Available plans, or upgrade the plan, and then create the webhook.
2

Create the webhook in Snyk through the API

Where: A terminal that can reach the Snyk API (the Snyk console has no webhook entry)Call the Create a webhook API with these body fields:Snyk has no separate recovery setting: Flashduty recovers an alert from removedIssues (whether Snyk lists an issue there when a retest no longer finds it is not stated in the Snyk documentation, so it is unconfirmed).
The response id is the webhook ID, which you need for testing and deleting the webhook.
3

Send a test with the ping API

Where: A terminal that can reach the Snyk API › Ping a webhook APISnyk sends a ping/v0 event right after the webhook is created. You can send it again with the ping API:
The test event opens a separate Info alert in Flashduty titled Snyk test notification. It is not linked to any real issue and no recovery follows, so close it by hand once you have seen it arrive.
4

Retest a project in Snyk and verify the alert lifecycle

Where: Snyk console › ProjectsWait for (or trigger) a project retest and confirm that a new issue opens an alert in Flashduty. Fix the issue, for example by upgrading the dependency, retest, and confirm that the alert recovers. The ping event only proves that the network and URL work; verify issue alerts and recovery with a real retest.

About the signature

Snyk signs each request in the X-Hub-Signature header (sha256=<hex HMAC digest>, keyed with the secret you set when creating the webhook). Flashduty does not verify it, so secret can be any random string. The integration_key in the push URL is the only credential; keep it private.

Alert key

Flashduty builds the Alert Key from the project ID (project.id) plus the issue ID (id): one alert per issue per project. Issues in newIssues and removedIssues share the same shape and id, so an issue appearing and disappearing land on the same alert. Changes to the project name, branch, or severity do not change the Alert Key. An issue that repeats for several dependency paths of one project produces a single alert. The same issue in two projects is two alerts.

Status and severity

Flashduty acts only on issues listed in newIssues and removedIssues. The Snyk docs do not say whether ignoring an issue lists it in removedIssues. Turn on auto-close on timeout for the channel as a safety net so alerts do not stay open indefinitely. One request processes at most the first 100 issues of newIssues and of removedIssues (sorted by issue ID); issues beyond that create no alert. Alert labels include the project ID and name, project type, branch, organization, issue ID, package name and versions, CVE, CWE, CVSS score, and the fixed-in version. The importing user’s name and email are not written to the alert.

Troubleshooting

  • The create call returns an error: check that url is HTTPS, the token has access to the organization, the organization is in a region where Snyk webhooks are available, and the plan includes API access (the Free plan returns not entitled for api access)
  • No alerts arrive: Snyk sends an event only when a project is retested and it is not sent when a project is first imported. Make sure the project’s scan type is Open Source or Container
  • An alert does not recover: only issues listed in removedIssues recover their alerts
  • A test alert appeared: it comes from the ping/v0 event. Close it by hand
For more information, see the Snyk docs Webhook events and payloads and About webhooks.