Overview

Push events out of Vanta the moment they happen, delivered to your endpoints or Discord.

Webhooks deliver your project's events as soon as they arrive. Instead of polling the API, you register a watch on an event type and Vanta POSTs each matching event to your endpoint, or posts a formatted message into a Discord channel. Delivery happens asynchronously through a background worker, so it never slows down event ingestion.

How webhooks work

A webhook watches one or more event types in one project. Every time an event of one of those types is tracked, Vanta enqueues a delivery. Each delivery attempt is recorded with its status, HTTP response, and duration, so you can audit exactly what happened and retry a specific failure from the dashboard.

Webhook types

TypeDelivers to
httpA signed JSON payload to any public HTTPS endpoint you control.
discordMessage content and rich embeds to a Discord channel via a Discord webhook URL.

What triggers a delivery

A webhook can watch several event types at once (up to twenty). When you select triggers, the picker groups them by category:

  • Vanta internal: reserved monitoring and analytics events such as $page and $increment.
  • Uptime incidents: incident.started, fired when a monitor goes down, and incident.recovered, fired when it comes back.
  • Application events: your own event types, discovered automatically from tracked data.
  • Custom: a type you enter that has not been seen yet.

Incident notifications are at most once: each time an incident opens and each time it recovers, at most one delivery is enqueued for the webhook. Because webhooks are scoped to a project and delivered with an event payload, you can target deliveries to the exact signals you care about rather than receiving everything.

Delivery reliability

Vanta retries failed deliveries with exponential backoff and gives up after a limited number of attempts, so a transient outage does not lose events. Each delivery has a signing header so you can verify it came from Vanta. See Payloads and Signatures for the full retry policy and verification code.

http
POST /your/endpoint HTTP/1.1
User-Agent: Vanta-Webhooks/1.0
X-Vanta-Signature: t=1756026000,v1=a3f0...
X-Vanta-Event-Id: e1f4c6d2...
X-Vanta-Delivery-Id: b8c2e9a1...
Content-Type: application/json