Skip to main content

Webhook Payload

A Firewall quarantine webhook payload is the JSON body sent via HTTP POST to your configured URL when a component is quarantined by firewall due to a policy violation. The payload includes repository, component, policy, and request context. A complete structure of the payload is given below:

{
  "timestamp": "2026-02-23T10:56:00.000Z",
  "initiator": "admin",
  "nodeId": "node-abc123",
  "event": "FIREWALL_QUARANTINE_DOWNLOAD_BLOCKED",
  "repository": "maven-central",
  "repository_format": "maven2",
  "component_identifier": {
    "format": "maven2",
    "coordinates": {
      "groupId": "org.apache.logging.log4j",
      "artifactId": "log4j-core",
      "version": "2.14.1"
    },
    "purl": "pkg:maven/org/apache/logging/log4j/[email protected]"
  },
  "asset_path": "/org/apache/logging/log4j/log4j-core/2.14.1/log4j-core-2.14.1.jar",
  "asset_checksums": {
    "sha1": "fca480c9018010760e5e2e1eaed9c2b0546e7138",
    "sha256": "e16500ad571de1612e4ff8555c179b41596d6322e915b5a221e134d0571d4bf0",
    "md5": "4f100dfb02f121b34a9c472d829e9a7a"
  },
  "quarantine_status": "QUARANTINE",
  "quarantine_reasons": [
    {
      "policy_name": "Security-Critical",
      "threat_level": 10,
      "violations": [
        {
          "constraint_name": "Security Vulnerability Severity >= 9",
          "reasons": [
            "CVE-2021-44228 (CVSS Score: 10.0)",
            "CVE-2021-45046 (CVSS Score: 9.0)"
          ]
        }
      ]
    },
    {
      "policy_name": "License-Copyleft",
      "threat_level": 7,
      "violations": [
        {
          "constraint_name": "GPL License",
          "reasons": [
            "Component has GPL license"
          ]
        }
      ]
    }
  ],
  "firewall_report_url": "http://localhost:8072/ui/links/firewall/repositories/quarantinedComponent/abc123",
  "quarantine_timestamp": "2026-02-23T10:56:00.000Z",
  "action": "BLOCKED",
  "http_method": "GET",
  "http_status": 403,
  "username": "admin",
  "realm": "NexusAuthenticatingRealm",
  "user_ip_address": "192.168.1.100",
  "user_agent": "Maven/3.8.1"
}

Field Descriptions

Top Level Fields

Field

Description

timestamp

Time when the webhook was generated

initiator

Username of the user who triggered the download

nodeId

Nexus cluster node ID that generated the event

event

Always "FIREWALL_QUARANTINE_DOWNLOAD_BLOCKED"

repository

Repository name where download was attempted

repository_format

Format Name - maven2, npm, docker, pypi, nuget, etc.

component_identifier

Optional; Parsed component coordinates (see below)

asset_path

Full path to the asset within the repository

asset_checksums

Map of checksum algorithms to values

quarantine_status

BLOCKED or QUARANTINED

quarantine_reasons

List of policy violations (see below)

firewall_report_url

Optional; Direct link to IQ Server report

quarantine_timestamp

Time when component was quarantined

action

BLOCKED or QUARANTINED

http_method

HTTP method of the download request (usually "GET")

http_status

HTTP status code returned (403 for blocked)

username

Username from authentication

realm

Authentication realm

user_ip_address

Optional; Client IP address

user_agent

Optional; Client User-Agent header

Component Identifier Object

Field

Description

format

Repository format

coordinates

Format specific coordinates

purl

Package URL (PURL) - universal component identifier

Note

component_identifier may be null for:

  • Non-standard asset paths

  • Metadata files (pom.xml, package.json, etc)

  • Docker blobs (non-manifest requests)

Quarantine Reasons Array

Field

Description

policy_name

Name of the violated IQ Server policy

threat_level

IQ threat level (0-10; higher = more severe)

violations

List of constraint violations within this policy

Every violation object contains the following fields:

Field

Description

constraint_name

Name of the constraint that was violated

reasons

Specific reasons (CVE IDs with scores, license names, etc.)

When quarantine_reasons contains only the following codeblock, it indicates a repeat access attempt to an already quarantined component (no new policy evaluation).

{
"policy_name": "Subsequent access to previously quarantined component",
"threat_level": 0,
"violations": [ ]
}

Example: Log4Shell Vulnerability Payload (First-Time Quarantine)

The following is an example payload for first time quarantine of log4Shell vulnerability.

{
  "event": "FIREWALL_QUARANTINE_DOWNLOAD_BLOCKED",
  "repository": "maven-central",
  "repository_format": "maven2",
  "component_identifier": {
    "format": "maven2",
    "coordinates": {
      "groupId": "org.apache.logging.log4j",
      "artifactId": "log4j-core",
      "version": "2.14.1"
    },
    "purl": "pkg:maven/org/apache/logging/log4j/[email protected]"
  },
  "quarantine_status": "QUARANTINED",
  "quarantine_reasons": [
    {
      "policy_name": "Security-Critical",
      "threat_level": 10,
      "violations": [
        {
          "constraint_name": "Security Vulnerability Severity >= 9",
          "reasons": [
            "CVE-2021-44228 (CVSS Score: 10.0)",
            "CVE-2021-45046 (CVSS Score: 9.0)",
            "CVE-2021-45105 (CVSS Score: 7.5)"
          ]
        }
      ]
    }
  ],
  "action": "QUARANTINED",
  "http_status": 403,
  "username": "developer",
  "user_agent": "Apache-Maven/3.8.1"
}

The "action": "QUARANTINED" indicates that it is the first time a component was evaluated and blocked. Complete policy violation details are included.

Example: GPL License Violation Payload

The following is an example payload for first time quarantine of GPL license violation.

{
  "event": "FIREWALL_QUARANTINE_DOWNLOAD_BLOCKED",
  "repository": "npm-proxy",
  "repository_format": "npm",
  "component_identifier": {
    "format": "npm",
    "coordinates": {
      "packageId": "some-gpl-package",
      "version": "1.0.0"
    },
    "purl": "pkg:npm/[email protected]"
  },
  "quarantine_status": "QUARANTINED",
  "quarantine_reasons": [
    {
      "policy_name": "License-Copyleft",
      "threat_level": 7,
      "violations": [
        {
          "constraint_name": "GPL License",
          "reasons": [
            "Component has GPL-3.0 license"
          ]
        }
      ]
    }
  ],
  "action": "QUARANTINED",
  "http_status": 403
}

Example: Subsequent Access Payload

The following example illustrate the webhook payload for subsequent access to a previously quarantined component.

{
  "event": "FIREWALL_QUARANTINE_DOWNLOAD_BLOCKED",
  "repository": "maven-central",
  "repository_format": "maven2",
  "component_identifier": {
    "format": "maven2",
    "coordinates": {
      "groupId": "org.apache.logging.log4j",
      "artifactId": "log4j-core",
      "version": "2.14.1"
    },
    "purl": "pkg:maven/org/apache/logging/log4j/[email protected]"
  },
  "quarantine_status": "BLOCKED",
  "quarantine_reasons": [
    {
      "policy_name": "Subsequent access to previously quarantined component",
      "threat_level": 0,
      "violations": []
    }
  ],
  "action": "BLOCKED",
  "http_status": 403,
  "username": "developer",
  "user_agent": "Apache-Maven/3.8.1"
}

The "action": "BLOCKED" indicates this component was already in quarantine. No new policy evaluation was performed. The original policy violation details are not included in this webhook.