SonarQube Reporting Webhooks

Learn how SonarQube webhooks work in Procurize AI, including setup, payload structure, security validation, and retry behavior.

Overview

Procurize webhooks allow external systems to receive notifications when new SonarQube reports are ingested or updated.

Configuring webhooks

Webhooks can be added or edited it in the Organization’s settings panel, Security reports section at https://dashboard.procurize.ai. Please note that access to the settings panel requires authorization, and access to the organization’s settings panel requires a user role of at least Administrator in that organization.

Webhooks editor

To check webhooks, you can use popular online services such as https://webhook-test.com

Webhook Payload

Webhook events are delivered as HTTP POST requests with a JSON payload.

Example Payload

{
  "organizationId": "00000000-0000-0000-0000-000000000001",
  "reports": [
    {
      "projectName": "Test product",
      "id": "00000000-0000-0000-0000-000000000002",
      "reportType": "CWE Top 25",
      "reportVersion": 2024,
      "projectVersion": "1.0",
      "date": "2025-12-17T09:05:48.5946432+00:00",
      "uploadDate": "2025-12-17T09:05:48.5946432+00:00",
      "vulnerabilitiesCount": 0,
      "securityRating": "A"
    }
  ]
}

Webhook Security

To ensure authenticity, webhook requests include a signature header generated using a shared secret.

The signature is calculated using HMAC-SHA256
Clients should verify the signature before processing the payload

This prevents unauthorized or spoofed webhook deliveries.

Delivery and Retries

Webhooks expect a 2xx response to be considered successfully delivered
Failed deliveries are automatically retried hourly.
Events may be delivered more than once; consumers should implement idempotent processing

Typical Use Cases

Automatically ingest SonarQube findings into internal security dashboards
Trigger compliance workflows when quality gates fail
Archive security reports for audits and vendor risk reviews
Keep third-party systems synchronized with the latest code security posture