Authentication
Create a webhook in Settings → Connections → Webhooks. Save its API key, which is shown only once, and its Trigger URL.Content-Type: application/json and X-Webhook-Secret: <api-key>.
Trigger a query
The trigger returns 202 Accepted:
jobToken authorizes reading this job’s result for about one hour. workflowId is deprecated. Poll using the returned URL and bearer token; do not put the token in a URL.
Polling for results
An expired token returns
403. Retriggering creates another job with a fresh token; it does not resume the old job.
Push destinations
To send results to Slack, add:slackThreadTs for a channel message. For an external endpoint, use webhookUrl instead:
Response payload
Macroscope POSTs this JSON to an external destination:URL allowlisting
A GitHub organization admin must add external destinations in Settings → Connections → Webhooks → Allowed External URLs. Destinations must be public HTTPS endpoints without embedded credentials. Private, loopback, link-local, and reserved addresses are rejected, including hostnames resolving to them at delivery time. Redirects are not followed: a3xx is a delivery failure. Allowlist the final endpoint.