Webhook

Anchore Enterprise uses outgoing webhooks to send event notifications to external services. When a webhook is triggered, Anchore makes a POST request to the registered URL.

Note

For internet connected systems you may wish to test your webhooks with https://webhook.site/

Headers

Header	Value
Content-Type	application/json
Authorization	Basic (if configured)
User-Agent	python-requests/x.x.x
Accept	/

Payload Example

The following represents a payload example in the body of the webhook POST request:

{
  "id": "string",
  "type": "string",
  "level": "string",
  "message": "string",
  "details": {
    "msg": "string"
  },
  "timestamp": "ISO-8601 string",
  "resource": {
    "account_name": "string",
    "type": "string",
    "id": "string | null"
  },
  "source": {
    "request_id": "string | null",
    "service_name": "string",
    "host_id": "string",
    "base_url": "string"
  }
}

Payload Details

According to the example above, the fields are described as follows:

Field	Description
id	Unique identifier of the webhook event
type	Event type (e.g., system.test.random_wisdom, policy_eval, analysis_update)
level	Severity level (info, warn, error)
message	Human-readable description of the event
details	Object containing additional event-specific data

Details regarding where the resource and event type:

Field	Description
timestamp	Event timestamp in ISO-8601 format
account_name	Anchore account where the event originated
type	Type of resource (e.g., wisdom, image, policy)
id	Identifier for the resource (nullable)

Details regarding the source of the event:

Field	Description
request_id	ID of the request (nullable)
service_name	Anchore service that generated the event
host_id	Pod or container identifier
base_url	Base URL of the Anchore API

Example Payload

{
  "id": "211c5fff5641456d935e60f905c46a66",
  "type": "system.test.random_wisdom",
  "level": "info",
  "message": "Unsolicited random wisdom of the moment",
  "details": {
    "msg": "It is better to keep your mouth closed and let people think you are a fool than to open it and remove all doubt - Mark Twain"
  },
  "timestamp": "2025-10-01T09:08:54.749806",
  "resource": {
    "account_name": "admin",
    "type": "wisdom",
    "id": null
  },
  "source": {
    "request_id": null,
    "service_name": "apiext",
    "host_id": "anchore-enterprise-api-b7d8c686b-p6wbr",
    "base_url": "http://anchore-enterprise-api.anchore.svc.cluster.local:8228"
  }
}

Example of failed analysis

This is a notification due to an image not found in registry.

{
  "id": "5fb694f3c245447cb1302ec412b490fe",
  "source": {
    "service_name": "catalog",
    "host_id": "anchore-enterprise-catalog-5654fb8d84-5ln8r",
    "base_url": "http://anchore-enterprise-catalog.anchore.svc.cluster.local:8082",
    "request_id": null
  },
  "resource": {
    "account_name": "admin",
    "id": "docker.io/sopuru24/alpine:latest",
    "type": "image_reference"
  },
  "type": "system.image_analysis.registry_lookup_failed",
  "level": "error",
  "message": "Referenced image not found in registry",
  "details": {
    "anchore_error_json": {
      "message": "cannot fetch image digest/manifest from registry",
      "detail": {
        "raw_exception_message": "could not get manifest/digest for image (docker.io/sopuru24/alpine:latest) from registry (https://index.docker.io) - error: Error encountered in skopeo operation. cmd=/bin/sh -c skopeo inspect --raw   --tls-verify=true --creds \"${SKOPUSER}\":\"${SKOPPASS}\" docker://docker.io/sopuru24/alpine:latest, rc=2, stdout=None, stderr=b'time=\"2025-10-01T10:43:27Z\" level=fatal msg=\"Error parsing image name \\\\\"docker://docker.io/sopuru24/alpine:latest\\\\\": reading manifest latest in docker.io/sopuru24/alpine: manifest unknown\"\\n', error_code=REGISTRY_IMAGE_NOT_FOUND",
        "error_codes": []
      },
      "httpcode": 400
    }
  },
  "timestamp": "2025-10-01T10:43:27.011960Z"
}

Last modified October 17, 2025