Per-user secret
whsec_* generated at creation for verifying deliveries.
API & Tools
Webhooks to your HTTPS endpoints
Register HTTPS URLs to receive eight platform events. Manage endpoints from the dashboard or the REST API under /user/webhooks.
No credit card required · Free API key
Events
11 event types, one HTTPS POST each.
| Event | Fires when | Key fields |
|---|---|---|
| threat.detected | A report or lookup produced a malicious or high-risk verdict. | entity, riskScore, dataTrust, evidence, caseUrl |
| monitor.alert | A monitored domain or IP changed status or raised a new alert. | alertId, entity, severity, recommendedAction, dataTrust |
| report.created | A new threat report was saved. | reportId, entity, entityType, createdAt |
| usage.warning | Usage is approaching a plan limit. | usageType, current, limit, plan |
| cve.finding.created | A CVE affects a component of your watched stack: priority, proof, the components with version, affected range and fix. | findingId, cveId, severity, epssScore, kev, perimeter |
| cve.finding.status_changed | A finding moved to a new status, set by a member or closed by a read of the fixed version. | findingId, cveId, status, previousStatus, updatedAt, perimeter |
| case.updated | A case status, priority or evidence timeline changed. | caseId, status, priority, evidenceCount |
| dataset.stale | A dataset passed its freshness threshold or became unavailable. | datasetKey, status, ageHours, lastSuccessAt |
| cve.finding.escalated | A CVE in your stack has new evidence: added to CISA KEV, exploitation reported, a public proof of concept or a fix released. | findingId, cveId, priority, previousPriority, changes, components |
| cve.exploited | A CVE became exploited (CISA KEV, another exploitation catalogue, CISA SSVC active). Sent only to subscriptions that name this event. | cveId, commonName, exploitationStatus, firstSeenAt, sources, inYourStack |
| cve.digest | The daily or Monday digest of what is new or changed on your watched stack. | kind, periodStart, periodEnd, counts, items |
REST API
Manage endpoints under /user/webhooks.
| Route | Action |
|---|---|
| POST /user/webhooks | Create an endpoint; a whsec_ secret is generated |
| GET /user/webhooks | List your endpoints |
| GET /user/webhooks/:id | Read one endpoint, failure_count included |
| PATCH /user/webhooks/:id | Update an endpoint |
| DELETE /user/webhooks/:id | Delete an endpoint |
| GET /user/webhooks/events | List event types and their fields |
curl -X POST "https://api.ismalicious.com/user/webhooks" \
-H "X-API-KEY: YOUR_BASE64_CREDENTIALS" \
-H "Content-Type: application/json" \
-d '{"name":"Production","url":"https://hooks.example.com/ism","events":["threat.detected","monitor.alert"]}'- Event types
- 11
- Endpoints on Basic
- 2
- Endpoints on Pro and Enterprise
- 10
- Delivery URLs only
- HTTPS
Capabilities
Key features at a glance.
Plan limits
2 endpoints on Basic, 10 on Pro and Enterprise.
Same auth
X-API-KEY Base64 or logged-in session.
Applications
Use cases to evaluate first.
Automation
Drive internal workflows when threats or alerts fire.
SIEM
Forward structured events to your ingest endpoint.
IaC
Provision webhooks via API from Terraform or scripts.
FAQ
Frequently asked questions.
Is this incoming Stripe-style?
No — /webhook/stripe is separate (Stripe only). User webhooks are your URLs we POST to.
Are these routes in OpenAPI?
openapi.json documents GET /user/webhooks/events. The other routes are listed on this page.
How are failed deliveries tracked?
Each endpoint keeps a failure_count, returned by GET /user/webhooks.
Explore
Related tools and pages.
Test it with your own indicators.
The free plan includes website lookups with no monthly cap and 250 API requests a month. Check the sources and limits, then connect the API.
No credit card required · Free API key