Webhooks
A webhook subscribes a URL to event types; the worker posts each event to the enabled webhooks subscribed to it. A delivery without a 2xx answer is retried, backing off from 30 seconds to 32 minutes, 8 attempts in all. Deliveries are kept 30 days. Disabled webhooks get nothing.
For private addresses, set RELIC_WEBHOOK_ALLOW_PRIVATE_ADDRESSES=true on the
server and the worker.
The URL cannot hold a user or password. Administrators see the whole URL; viewers see its scheme and host only, since webhook URLs often carry a token.
| Event | When |
|---|---|
artifact.deployed | a file is deployed to a local repository |
artifact.deleted | a file or folder is deleted |
scan.finished | a file was scanned |
download.blocked | a download was blocked |
release.promoted | a release version was promoted |
quarantine.released, quarantine.rejected | a quarantined file was decided on |
* subscribes to every event type.
Payload
The json format posts the event:
{
"id": "0192f7a0-5d1e-7c3a-9b2f-6e4d8a1c0b7e",
"type": "artifact.deployed",
"subject": "libs-release/org/acme/app/1.0/app-1.0.jar",
"actor": "ci-bot",
"time": "2026-10-05T12:00:00Z",
"data": {"repository": "libs-release", "path": "org/acme/app/1.0/app-1.0.jar", "sha256": "…", "size": 1024}
}
Requests carry X-Relic-Event (the type) and X-Relic-Delivery (the id). The
slack format posts {"text": …} to a Slack incoming webhook.
Signatures
With a secret, X-Relic-Signature is sha256= and the hex HMAC-SHA256 of the
body. Compare it with your own in constant time.
Managing webhooks
Manage webhooks in Administration → Webhooks, or as relic.build/v1
resources:
apiVersion: relic.build/v1
kind: Webhook
metadata: {name: ci-notify}
spec:
url: https://ci.example.com/hooks/relic
events: [artifact.deployed, release.promoted]
format: json
enabled: true
secret: change-me
Apply the file:
relic apply -f webhooks.yaml
Send a test webhook.ping:
relic webhook ping ci-notify
List the latest deliveries:
relic webhook deliveries ci-notify