How to Receive a Webhook When an Xray Scan Finishes

Use a JFrog Platform webhook to notify an external system when an Xray scan reaches a terminal overall status. The webhook payload includes resource coordinates (for example, repository, path, and artifact name) and per-service scan status for SCA, violations, exposures, and contextual analysis.

Step 1: Create a Platform webhook

Goal: Open the webhook configuration flow in the JFrog Platform.

1. Select All Projects, or from the Projects list, select the project whose scan events you want to receive.
2. Open the Platform module and go to Integrations > Webhooks.
3. Click New Webhook.

For general webhook settings (URL, HTTP method, proxy, secrets, and headers), see Custom Webhooks.

Step 2: Select Xray Scan Status events

Goal: Subscribe to terminal scan outcomes for scanned resources.

1. In the event picker, open Xray Scan Status.
2. Select one or more terminal outcomes:
   • Scan completed — overall status is DONE
   • Scan failed — overall status is FAILED
   • Scan partially completed — overall status is PARTIAL
   • Scan not supported — overall status is NOT_SUPPORTED
3. Click Save.

All selected event types deliver the same payload shape. The event type filters which terminal outcomes trigger your endpoint.

Step 3: Test the webhook

Goal: Confirm that your endpoint receives scan finished notifications.

1. Click Test on the webhook to send a sample request to your URL.
2. Trigger an Xray scan on a resource in scope (for example, deploy an artifact to a scanned repository).
3. When the scan reaches a terminal overall status, verify that your endpoint received the event.

Use the Troubleshooting tab to review delivery results when webhook troubleshooting is enabled on your instance. See Webhooks Troubleshooting.

Related information

• Webhook Event Types — Domain: Xray Scan Status — payload fields and examples for each terminal outcome.
• Custom Webhooks — create and manage Platform webhooks, including custom payloads and secrets.