---
title: "Receive penetration test webhook events"
method: POST
path: "/v1/security-penetration-tests/webhook"
tags: ["Security Penetration Tests"]
---

# Receive penetration test webhook events

`POST /v1/security-penetration-tests/webhook`

Receives signed JSON events from Maced. Signature is verified against MACED_WEBHOOK_SIGNING_SECRET using the SDK's verifyMacedWebhook helper.

## Headers

- `X-Organization-Id` string
- `X-Maced-Signature` string, required

## Response `200`

Webhook handled

## Other responses

- `400` — Invalid webhook payload
- `403` — Invalid webhook signature

## Changes

- **2026-04-30** `e3da57681861` — 1 breaking, 3 warning, 1 info
  - added the new required `header` request parameter `X-Maced-Signature`
  - deleted the `header` request parameter `X-Webhook-Id`
  - deleted the `header` request parameter `X-Webhook-Token`
  - deleted the `query` request parameter `webhookToken`
  - …1 more

[Change history](https://skmtc.dev/trycompai/apis/comp-ai-api/changes/v1/security-penetration-tests/webhook/post.md)

---

[API](https://skmtc.dev/trycompai/apis/comp-ai-api.md) · [All operations](https://skmtc.dev/trycompai/apis/comp-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/trycompai/comp-ai-api/revisions/9dbc609fc132/schema)