Skip to main content
🎉 Check out our latest June Release 🎉 Here

Search

Welcome to Whistic Support

Building Custom App Connectors (Through Webhooks)

  • Updated

Table of Contents

Summary

Whistic's Webhooks feature is a powerful integration solution that allows you to automatically send real-time notifications and updates to your external systems whenever specific events occur in your Whistic account. If you're looking for an integration with your existing tools and platforms, webhooks are often the perfect solution - they're flexible, reliable, and work with virtually any system that can receive HTTP requests.

🔗 Understanding Webhooks as Integrations

Looking for an integration? Webhooks might be exactly what you need! Many customers seek "integrations" when what they really need is a way to automatically send Whistic data to their existing tools. Webhooks provide this functionality seamlessly.

How Webhooks Work as Integrations

  1. Whistic monitors for specific events (vendor updates, assessment completions, Trust Center [profile] shares, etc.)
  2. When an event occurs, Whistic immediately sends data to your specified URL endpoint
  3. Your receiving system processes the data and can take automated actions
  4. No polling, scheduling, or manual data transfer required

Technology Agnostic

Webhooks don't care about your external technology stack. Whether you're using Slack, Microsoft Teams, ServiceNow, Archer, custom applications, ITSM tools, or any other platform - if it can receive HTTP requests, it can work with Whistic webhooks.

Note: Webhooks are event-driven, meaning they respond to actions taking place in real-time rather than running on a scheduled cadence. This ensures immediate data delivery when something important happens in your Whistic account.

📋 Event Types & Use Cases

Understanding which events to monitor is crucial for effective webhook implementation.

Vendor Breaches

Event Code Description
Vendor Breach Opened 1001 Vendor breach alert status changed to Open
Vendor Breach In Review 1002 Vendor breach alert status changed to In Review
Vendor Breach Resolved 1003 Vendor breach alert status changed to Resolved
Vendor Breach Closed 1004 Vendor breach alert status changed to Closed
Vendor Breach Created 1009 New vendor breach alert created
Vendor Breach Updated 1010 Vendor breach alert updated

My Organization Breaches

Event Code Description
MyOrg Breach Opened 1005 MyOrg breach alert status changed to Open
MyOrg Breach In Review 1006 MyOrg breach alert status changed to In Review
MyOrg Breach Resolved 1007 MyOrg breach alert status changed to Resolved
MyOrg Breach Closed 1008 MyOrg breach alert status changed to Closed
MyOrg Breach Created 1011 New MyOrg breach alert created
MyOrg Breach Updated 1012 MyOrg breach alert updated

Vendor Status Changes

Event Code Common Use Cases
Review In Progress 901 Notify security team that review has started
Awaiting Vendor 902 Alert vendor relationship manager
On Hold 903 Flag potential delays in project management tools
Manual Review 904 Assign to senior security analyst
Completed 905 Trigger compliance workflow
Approved 906 Update vendor database, notify procurement
Approved with Conditions 907 Create follow-up tasks
Review Pending 908 Add to review queue
Denied 909 Notify stakeholders, update CRM
Canceled 910 Clean up related workflows
Vendor Created 912 Initialize onboarding process
Needs Clarification 913 Send clarification request to vendor

Security Profile Events

Event Code Common Use Cases
Profile Shared 601 Notify recipients, log sharing activity
Profile Viewed 602 Track engagement, update view metrics
Profile Approval Requested 603 Route to appropriate approver

🚀 Getting Started

Requirements

  • Admin access to your Whistic account
  • A destination URL endpoint that can receive HTTP POST requests
  • Basic understanding of the events you want to monitor

Before You Begin

  1. Identify which Whistic events you want to track (vendor updates, assessments, profile shares, etc.)
  2. Identify which webhook type you wish to use from the following options:
    1. Standard Body
    2. JSON
    3. Custom
    4. Slack
    5. Microsoft Teams
  3. Confirm your destination system can accept webhook data via HTTP POST
  4. Have your endpoint URL ready (this is where Whistic will send the data)

⚙️ Step-by-Step Setup Guide

Step 1: Access Webhook Settings

  1. Log into your Whistic account
  2. Select Settings then Integrations
  3. Locate the App Connectors (Webhooks) tile and click the Configure button on it. This will land you in the Webhooks page

Screenshot 2025-12-31 at 19.08.53.png

Step 2: Add Your Webhook Endpoint

  1. Click New Webhook and select the type you wish to use

  1. Enter a descriptive name for your webhook (e.g., "Slack Security Notifications" or "ServiceNow Integration")
  2. Paste your destination URL endpoint in the Webhook URL field
  3. Add the email address for error notifications (highly recommended)
  4. Configure Optional Headers if authentication is required (API keys, tokens, etc.)
Important Note: Your endpoint URL must be able to receive HTTP POST requests. Most integration platforms (Slack, Teams, Zapier, etc.) provide webhook URLs specifically for this purpose.

Step 3: Configure Events and Messages

  1. Select the events you want to monitor by toggling them to the "on" position
  2. Use Available Keys to include dynamic data in your messages (vendor names, dates, etc.)
    • Helpful Tip - Type ${ to see available keys with autocomplete
  3. Format your messages according to your receiving system's requirements

Step 4: Test Your Webhook

  1. Click Test Webhook at the bottom of the configuration page
  2. Whistic will send test notifications for each enabled event
  3. Check your destination system to confirm the messages are received
  4. Verify the message format and content meet your needs

Step 5: Activate and Monitor

  1. Save your webhook configuration
  2. Monitor your destination system for incoming webhook data
  3. Use the error notification email to stay informed of any delivery issues

Sharing a Whistic Trust Center (Profile)

Sample Message Configuration:

A Whistic Profile was Shared!
Recipient:${recipientsEmail}
Profile: ${whisticProfileName}
Profile Link:${whisticProfileLink}
Shared from: ${sharedSource}
Sales Rep Name: ${salesrepName}
Sales Rep Email: ${salesrepEmail}

Result in Slack:

A Whistic Profile was Shared!
Shared by: support@whistic.com
Recipient: customer@company.com
Profile: Whistic Comprehensive
Profile Link: https://console.whistic.com/v2/console/whistic-profile/external_identifier
Shared from: Whistic

Slack Integration

Webhook URL Format: https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK

Sample Message Configuration:

Vendor Assessment Update: {{vendor_name}} status changed to {{status_name}} on {{date}}.
Review details: {{assessment_url}}

Result in Slack:

Vendor Assessment Update: Acme Corp status changed to Approved on 2024-08-18.
Review details: https://app.whistic.com/assessments/12345

Microsoft Teams Integration

Webhook URL Format: https://outlook.office.com/webhook/YOUR-TEAMS-CONNECTOR-URL

Sample Message Configuration:

json
{
  "title": "Whistic Security Update",
  "text": "{{vendor_name}} profile was shared with {{recipient_email}} on {{share_date}}"
}

ServiceNow/ITSM Integration

Common Use Case: Automatically create incidents when vendors need clarification

Sample Message Configuration:

Priority: Medium
Summary: Vendor {{vendor_name}} requires clarification
Description: Assessment ID {{assessment_id}} needs review. Contact: {{vendor_contact}}

📦 Sample Webhook Payloads

Vendor Approved Event (Code: 906)

{
  "eventType": 906,
  "eventName": "Approved",
  "vendorName": "Acme Corporation",
  "vendorId": "12345",
  "assessmentId": "67890",
  "timestamp": "2024-08-10T14:30:14.882",
  "approvedBy": "security.team@company.com",
  "profileUrl": "https://app.whistic.com/profiles/12345"
}

Profile Shared Event (Code: 601)

{
  "eventType": 601,
  "eventName": "Profile Shared",
  "vendorName": "Beta Solutions",
  "vendorId": "54321",
  "sharedWith": "procurement@company.com",
  "sharedBy": "admin@company.com",
  "timestamp": "2024-08-10T09:15:08Z",
  "profileUrl": "https://app.whistic.com/profiles/54321"
}

🔧 Advanced Configuration

Security Best Practices

  • Always use HTTPS endpoints
  • Implement webhook signature validation if your platform supports it
  • Regularly rotate authentication credentials
  • Monitor webhook delivery logs for suspicious activity

Authentication Options

  • API Key in Headers: Add X-API-Key: your-secret-key in Optional Headers

Message Customization Advanced Tips

  • Conditional formatting: Use different message formats based on event criticality
  • Rich text support: Include markdown formatting for platforms that support it
  • Dynamic URLs: Build contextual links using available keys
  • Multi-language support: Customize messages for different regions/teams

📊 Managing Your Webhooks

Viewing Active Webhooks

  • All configured webhooks appear in Admin Tools Company Settings Webhooks
  • View webhook names, URLs, active status, and last delivery time at a glance
  • Use status indicators to quickly identify inactive or failing webhooks

Editing Webhooks

  1. Click on any existing webhook to modify its configuration
  2. Update URLs, event selections, or message formats as needed
  3. Remember to test after making changes
  4. Save changes to activate updates

Webhook Management Best Practices

  • Use descriptive names that indicate purpose and destination
  • Document your webhook configurations for team reference
  • Regularly review and cleanup unused webhooks
  • Monitor performance metrics and adjust as needed

Monitoring Webhook Performance

  • Enable error notifications to receive alerts if webhook delivery fails
  • Regularly verify your external systems are receiving and processing webhook data
  • Check your destination system's logs for webhook delivery confirmation
  • Set up monitoring dashboards in your receiving systems

Screenshot 2025-12-26 at 12.42.34 PM.png

🔍 Troubleshooting Guide

Common Issues and Solutions

Webhook Not Receiving Data

Symptoms: No data appearing in destination system Solutions:

  1. Verify endpoint URL is correct and accessible from the internet
  2. Test your endpoint independently using tools like Postman or curl
  3. Ensure your receiving system can accept HTTP POST requests
  4. Check firewall settings - ensure Whistic's IP ranges aren't blocked
  5. Confirm the webhook is enabled and events are properly selected
  6. Review error notification emails for specific failure reasons

Incorrect Message Format

Symptoms: Messages received but format is wrong Solutions:

  1. Review message customization settings in webhook configuration
  2. Ensure dynamic keys are properly formatted (e.g., ${vendor_name})
  3. Test with simple messages first, then add complexity
  4. Check your receiving system's expected message format documentation
  5. Use the test webhook feature to validate format before going live

Intermittent Delivery Issues

Symptoms: Webhooks work sometimes but not consistently Solutions:

  1. Monitor error notification emails for patterns and timing
  2. Verify your endpoint system's availability and response times
  3. Check for rate limiting on your receiving system
  4. Implement retry logic on your receiving end for failed requests
  5. Consider webhook queuing if your system has performance limitations

Authentication Failures

Symptoms: 401/403 errors in webhook delivery Solutions:

  1. Verify API keys and tokens are correct and active
  2. Check authentication header format matches requirements
  3. Ensure credentials haven't expired and rotate if necessary
  4. Test authentication independently of webhook delivery

Getting Help with Event Selection

  • Start with high-impact events like vendor assessments or profile shares
  • Monitor webhook traffic and adjust event selection based on your needs
  • Consider your team's workflow and which notifications would be most valuable
  • Use a phased approach - start with a few events, then expand based on success

⚡ Performance & Limitations

Expected Performance

  • Delivery Speed: Webhooks are delivered in real-time, typically within 2-5 seconds of the triggering event
  • Retry Logic: Failed deliveries are retried up to 3 times with exponential backoff
  • Timeout: Webhook requests timeout after 30 seconds
  • Concurrent Deliveries: Multiple webhooks can be delivered simultaneously

Usage Limitations

  • Rate Limiting: Standard accounts support up to 100 webhook deliveries per minute
  • Payload Size: Maximum payload size is 1MB per webhook
  • Event History: Error logs are retained indefinitely
  • Active Webhooks: Up to 10 active webhooks per account (contact support for higher limits)

Optimisation Tips

  • Batch similar events when possible to reduce webhook volume
  • Use efficient endpoint processing to handle high-volume scenarios
  • Implement proper error handling to avoid unnecessary retries
  • Monitor your receiving system's performance under webhook load

❓ FAQ

Integration and Setup Questions

What's the difference between webhooks and other integrations?

  • Webhooks are a type of integration that sends real-time data to external systems when events occur. Unlike scheduled integrations that run at set times, webhooks provide immediate notifications. They're often simpler to set up than formal API integrations and work with virtually any system that can receive HTTP requests.

Can I use webhooks with my existing tools even if Whistic doesn't have a specific integration?

  • Yes! This is one of the main advantages of webhooks. As long as your tool can receive HTTP requests via a URL (which most modern platforms can), you can integrate it with Whistic using webhooks. Popular platforms like Slack, Microsoft Teams, ServiceNow, Archer, Zapier, and most ITSM tools all support webhook integrations.

What technical knowledge do I need to set up webhooks?

  • While webhooks do require some technical understanding, most modern platforms make it easy by providing webhook URLs for you to use. You typically need to know how to configure your receiving system to accept HTTP POST requests and how to format the expected message content. Our step-by-step guides above should help bridge any knowledge gaps.

Performance and Reliability Questions

How quickly are webhooks delivered?

  • Webhooks are delivered in real-time, typically within 2-5 seconds of the triggering event. This makes them ideal for immediate notifications and automated workflows that need to respond quickly to changes in your vendor management process.

What happens if my webhook endpoint is temporarily unavailable?

  • Whistic will attempt to deliver the webhook up to 3 times with exponential backoff (immediate, 1 minute, 5 minutes). If delivery continues to fail, you'll receive an error notification email (if configured). We recommend implementing basic retry logic on your receiving system for maximum reliability.

Are there any limits on webhook usage?

  • Standard accounts support up to 100 webhook deliveries per minute and up to 10 active webhooks. Webhook limits depend on your Whistic account configuration.

Customization and Management Questions

Can I customize what data is sent in webhooks?

  • We have expanded our options on the data that is sent in webhooks. Please look at available keys and reach out to Support if you are unable to locate an item you wish to pass through the webhook being created.

Can I set up multiple webhooks for different purposes?

  • Absolutely! You can create multiple webhooks pointing to different endpoints, each configured for specific events and use cases. For example, you might have one webhook for Slack notifications, another for your ITSM system, and a third for a custom application.

Can I see a history of webhook deliveries?

  • Error logs for failed deliveries are available in the Admin Tools Company Settings Event Logs section. For successful deliveries, you'll need to check your receiving system's logs or implement logging on your end. We recommend setting up monitoring in your receiving systems to track webhook delivery success.

Event and Timing Questions

Do webhooks work on a schedule or are they event-driven?

  • Webhooks are purely event-driven - they only fire when specific actions occur in your Whistic account. This means you get immediate notifications without the overhead of scheduled polling or batch processing.

Which events should I start with?

  • We recommend starting with high-impact events that align with your workflow:
    • For security teams: Vendor Approved (906), Manual Review (904), Needs Clarification (913)
    • For procurement: Vendor Created (912), Assessment Completed (905)
    • For compliance: Profile Shared (601), Approved with Conditions (907)

Can I get notifications for questionnaire completion percentages?

  • Currently, webhook events focus on status changes rather than progress indicators. Questionnaire completion percentages, initial assessments, and similar progress events are not available as webhook triggers at this time.

📚 Additional Resources