---
title: "Run completion delivery"
method: POST
path: "run.completed"
---

# Run completion delivery

`POST run.completed` (webhook)

Delivered to each subscribed endpoint. x-index365-signature is t=<unix>,v1=<hmac-sha256 of '<t>.<body>'>; verify v1 against the raw body, reject timestamps older than five minutes, then use id or x-index365-event-id for idempotency.

## Headers

- `x-index365-event` 'run.completed' | 'run.failed', required
- `x-index365-event-id` string, required
- `x-index365-signature` string, required

## Payload

- object: Outbound HMAC-signed event envelope. x-index365-signature is t=<unix>,v1=<hmac-sha256 of '<t>.<body>'>; verify v1 against the raw body before processing.
  - `id` string, required
  - `type` 'run.completed' | 'run.failed', required
  - `createdAt` string, date-time, required
  - `data` object, required
    - `runId` string, uuid, required
    - `projectId` string, uuid, nullable, required
    - `status` 'completed' | 'failed', required
    - `url` string, uri, required
    - `score` integer, nullable, required
    - `scoreStatus` 'unverified' | 'null', nullable, required: unverified means source-only evidence cannot support a numeric score claim, so score is null.
    - `severityCounts` object, nullable, required
    - `findingsTotal` integer, nullable, required
    - `error` string, nullable, required
    - `humanUrl` string, uri, required
    - `apiUrl` string, uri, required

## Acknowledgement `200`

Receiver acknowledged the delivery.

---

[API](https://skmtc.dev/index365/apis/index365-api.md) · [All operations](https://skmtc.dev/index365/apis/index365-api/llms.txt) · [OpenAPI document](https://skmtc.dev/index365/apis/index365-api/revisions/87dd7b85edcb?raw)