plugin.scan_failed

⚠️

Preview — this feature is being built; the design below is the spec.

Sent when: A Syntic Code plugin version failed its security scan and will not be served.

Property	Value
Scope	The whole organization. Register with an Admin key at `/v1/organizations/webhooks`.
Area	Syntic Code
Subscribe with	`"events": ["plugin.scan_failed"]`, or a prefix such as `"plugin.*"`

Payload

{
  "id": "evt_01JCA5D7F9H1K3M5P7R9",
  "type": "plugin.scan_failed",
  "created_at": "2026-11-05T10:00:00Z",
  "organization_id": "org_01J9X8Z6B4D2F0H8K6M4",
  "data": {
    "object": {
      "plugin_id": "plg_01JCN1P3R5T7V9X1Z3B5",
      "type": "plugin_version",
      "version": "1.5.0",
      "scan": {
        "status": "failed",
        "findings": [
          {
            "rule": "undeclared_executable",
            "path": "bin/postinstall.sh"
          }
        ]
      }
    }
  }
}

data.object matches what the corresponding GET endpoint returned when the event happened. Prompt and output text are never included.

What to do

Fix the findings and upload a new version.

Delivery

Deliveries are signed, retried with back-off for up to 3 days, and may arrive more than once or out of order. De-duplicate on the syntic-event-id header and compare timestamps before acting. See Webhooks.

tunnel.disconnected Sign in with Syntic

Was this page helpful?