---
title: "Receive penetration test webhook events"
method: POST
path: "/v1/security-penetration-tests/webhook"
tags: ["Security Penetration Tests"]
---

# Receive penetration test webhook events

`POST /v1/security-penetration-tests/webhook`

Receives callback payloads from the penetration test provider when a run is updated. Per-run webhook token validation is enforced when handshake state exists.

## Query parameters

- `webhookToken` unknown

## Headers

- `X-Organization-Id` string
- `X-Webhook-Token` string
- `X-Webhook-Id` string

## Response `200`

Webhook handled

## Other responses

- `400` — Invalid webhook payload

---

[API](https://skmtc.dev/trycompai/apis/comp-ai-api.md) · [All operations](https://skmtc.dev/trycompai/apis/comp-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/trycompai/comp-ai-api/revisions/2fc5a4abe081/schema)