Skip to main content

Firewall Webhook Event Types

Event - Container Evaluation

Use the container evaluation webhook to receive notifications when Firewall evaluates a Docker container image pulled through a Nexus Repository docker proxy repository.

Webhook Behavior

The container evaluation webhook fires each time a Docker container image is evaluated by Firewall. This webhook is only available for webhooks configured with the Firewall context.

Example Container Evaluation Event Payload

{
  "timestamp": "2026-04-20T10:30:00.000+00:00",
  "initiator": "admin",
  "id": "evaluation-event-id-123",
  "containerEvaluation": {
    "repository": {
      "id": "repo-internal-id",
      "publicId": "my-docker-proxy",
      "name": "My Docker Proxy",
      "organizationId": "org-id-abc"
    },
    "policyEvaluationId": "policy-eval-id-456",
    "stage": "proxy",
    "ownerId": "repo-internal-id",
    "evaluationDate": "2026-04-20T10:29:55.000+00:00",
    "affectedComponentCount": 12,
    "criticalComponentCount": 2,
    "severeComponentCount": 4,
    "moderateComponentCount": 6,
    "outcome": "fail",
    "reportId": "report-id-xyz",
    "isForLatestScan": true
  }
}

Event - Firewall Violation Alert

Use the violation alert webhook to receive notifications when Repository Firewall quarantines a component because it violates a Firewall policy. You can use this webhook to integrate quarantine events with external alerting, ticketing, and automation systems.

Configuration

Configure Violation Alert webhook notifications only through Repository Firewall.

To receive Violation Alert notifications:

  1. Create a Firewall webhook and select Violation Alert as the event type. For more information, see Create Webhooks.

  2. Open the Firewall policy for which you want to receive webhook notifications.

  3. In the Notifications section:

    voilation_alert_config.png

    1. Select Webhook as the Recipient Type.

    2. Select the webhook you created.

    3. Click Add.

      policy_voilation_checkbox.png

  4. Save the policy configuration.

Violation Alert webhook notifications follow the same notification inheritance hierarchy as Firewall email notifications.

  • Configure notifications at the appropriate owner level.

  • Child owners inherit the notification configuration from the nearest configured ancestor unless it is overridden.

  • Configure a custom notification to override the inherited configuration for the selected owner.

Webhook Behavior

The violation alert webhook is triggered when a component transitions from not quarantined to quarantined because of a Firewall policy evaluation.

The webhook is generated only for the initial quarantine event.

The webhook is not generated when:

  • An already quarantined component is evaluated again.

  • Continuous monitoring detects additional policy changes.

  • A quarantined component transitions to the fire stage.

Each webhook delivery includes information about:

  • Repository information

  • Firewall policy information

  • Quarantined component information

  • Quarantine status

Example Violation Alert Event Payload

Note

The payload header value for this event is:

x-nexus-webhook-id: iq:firewallPolicyAlert
{
  "timestamp": "2026-06-29T09:09:39.240+00:00",
  "initiator": "admin",
  "repository": {
    "id": "a7933e6ceb324fe29799a184c4174df1",
    "publicId": "maven-central",
    "format": "maven2"
  },
  "policyAlerts": [
    {
      "policyId": "75342e264fd2438f80b960db9defd506",
      "policyName": "Security-Critical",
      "threatLevel": 10,
      "componentFacts": [
        {
          "hash": "5af35056b4d257e4b64b",
          "displayName": "log4j : log4j : 1.2.17",
          "componentIdentifier": {
            "format": "maven",
            "coordinates": {
              "artifactId": "log4j",
              "classifier": "",
              "extension": "jar",
              "groupId": "log4j",
              "version": "1.2.17"
            }
          },
          "pathNames": [
            "log4j/log4j/1.2.17/log4j-1.2.17.jar"
          ],
          "constraintFacts": [
            {
              "constraintName": "Critical risk CVSS score",
              "satisfiedConditions": [
                {
                  "summary": "Security Vulnerability Severity >= 9",
                  "reason": "Found security vulnerability CVE-2019-17571 with severity >= 9 (severity = 9.8)"
                }
              ]
            }
          ]
        }
      ]
    },
    {
      "policyId": "75342e264fd2438f80b960db9defd506",
      "policyName": "Security-Critical",
      "threatLevel": 10,
      "componentFacts": [
        {
          "hash": "5af35056b4d257e4b64b",
          "displayName": "log4j : log4j : 1.2.17",
          "componentIdentifier": {
            "format": "maven",
            "coordinates": {
              "artifactId": "log4j",
              "classifier": "",
              "extension": "jar",
              "groupId": "log4j",
              "version": "1.2.17"
            }
          },
          "pathNames": [
            "log4j/log4j/1.2.17/log4j-1.2.17.jar"
          ],
          "constraintFacts": [
            {
              "constraintName": "Critical risk CVSS score",
              "satisfiedConditions": [
                {
                  "summary": "Security Vulnerability Severity >= 9",
                  "reason": "Found security vulnerability CVE-2022-23305 with severity >= 9 (severity = 9.8)"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "quarantineStatus": {
    "quarantined": true,
    "quarantineTime": "2026-06-29T09:09:39.180+00:00"
  }
}

Event - Firewall Waiver Request

Use the waiver request webhook to receive notifications when a user requests a waiver for a quarantined component. You can use this webhook to integrate waiver requests with external approval and notification workflows.

Webhook Behavior

The waiver request webhook is triggered whenever a user submits a waiver request for a quarantined component.

Note

Firewall Waiver Request webhooks are supported for Nexus Repository Manager proxy-stage evaluation. Firewall Enterprise integrations for Artifactory and Cloudsmith are not covered by this event.

Each webhook delivery includes information about:

  • The requester

  • The waiver request comment

  • The associated Firewall policy violation

  • Links to review and process the waiver request

Example Waiver Request Event Payload

Note

The payload header value for this event is:

x-nexus-webhook-id: iq:firewallWaiverRequest
{
  "timestamp": "2026-06-29T09:27:33.935+00:00",
  "initiator": "admin",
  "comment": "jj",
  "policyViolationId": "a7eea80e1ed84fa7ab9794d23ba52eab",
  "policyViolationLink": "http://localhost:8072/...",
  "addWaiverLink": "http://localhost:8072/...",
  "reviewWaiverRequestLink": "http://localhost:8072/...",
  "reasonId": "9b704ef5bc064fc29d7fe08a251ee9a6",
  "reasonText": "Acknowledged violation"
}

Event - Organization and Repository Management

Use the organization and repository management webhook to receive notifications when repository management changes occur. The webhook is also triggered once when it is created for the first time.

The payload for this webhook includes repository manager and repository-level fields so the event reflects the firewall-specific context.

This webhook can notify external systems when repository management actions occur, including:

  • Create

    When a repository management entry is created, a webhook is triggered.

    The event includes repository manager information and repository information.

  • Edit

    When a repository management entry is updated, a webhook is triggered.

    For example, if the name is changed, the webhook reflects the updated name.

  • Delete

    When a repository is deleted, a webhook is triggered.

    The resulting event reflects the repository state after the deletion.

Example Organization and Repository Management Event Payload

{
  "timestamp": "2026-04-20T10:30:00.000+00:00",
  "initiator": "admin",
  "repositoryManagers": [
    {
      "id": "rm-internal-id",
      "instanceId": "nxrm-instance-001",
      "name": "My Nexus Instance",
      "productName": "Nexus",
      "productVersion": "3.70.0",
      "baseUrl": "http://nexus.example.com:8013",
      "configured": true
    }
  ],
  "repositories": [
    {
      "id": "repo-id-001",
      "publicId": "npm-proxy",
      "repositoryManagerId": "rm-internal-id",
      "format": "npm",
      "repositoryType": "proxy",
      "auditEnabled": true,
      "quarantineEnabled": true
    },
    {
      "id": "repo-id-002",
      "publicId": "maven-central",
      "repositoryManagerId": "rm-internal-id",
      "format": "maven2",
      "repositoryType": "proxy",
      "auditEnabled": false,
      "quarantineEnabled": false
    }
  ]
}

Event - Waiver Expiration

Use the waiver expiration webhook to receive notifications when waiver expiration conditions are detected for the tenant where the webhook is configured.

Webhook Behavior

The waiver expiration webhook is tenant-specific. A webhook configured for one tenant only receives waiver expiration events for that tenant.

Notifications are generated for waivers that are:

  • expiring in 24 hours

  • expiring in 7 days

Tenant Scope

Each tenant manages its own webhook configuration and receives its own waiver expiration events. To receive notifications for multiple tenants, configure a webhook for each tenant.

Event Behavior

When waiver expiration processing runs, webhook deliveries reflect the waiver expiration condition for the tenant.

The webhook can indicate statuses such as:

  • expiring in 24 hours

  • expiring in 7 days

Example Waiver Expiration Event Payload - Expiring in 24 Hours

{
  "timestamp": "2026-04-20T10:30:00.000+00:00",
  "initiator": "SYSTEM",
  "eventType": "iq:waiverExpiration",
  "application": {
    "id": "app-internal-id"
  },
  "component": {
    "packageUrl": "pkg:npm/[email protected]",
    "format": "npm",
    "displayName": "[email protected]"
  },
  "policy": {
    "id": "policy-id-def",
    "name": "Integrity-Rating",
    "threatLevel": 9
  },
  "waiver": {
    "id": "waiver-id-abc",
    "expirationDate": "2026-04-21T23:59:59.999+00:00",
    "comment": "",
    "creatorUsername": "jsmith"
  },
  "status": "EXPIRING_IN_24_HOURS"
}

Example Waiver Expiration Event Payload - Expiring in 7 Days

{
  "timestamp": "2026-04-20T10:30:00.000+00:00",
  "initiator": "SYSTEM",
  "eventType": "iq:waiverExpiration",
  "application": {
    "id": "ROOT_ORGANIZATION_ID"
  },
  "component": {
    "packageUrl": "pkg:maven/org.example/[email protected]",
    "format": "maven2",
    "displayName": "org.example:library:1.2.3"
  },
  "policy": {
    "id": "policy-id-abc",
    "name": "Security-Medium",
    "threatLevel": 7
  },
  "waiver": {
    "id": "waiver-id-xyz",
    "expirationDate": "2026-04-27T23:59:59.999+00:00",
    "comment": "Temporary waiver pending vendor fix",
    "creatorUsername": "jsmith"
  },
  "status": "EXPIRING_IN_7_DAYS"
}