Skip to main content

Authentication

Create a webhook in Settings → Connections → Webhooks. Save its API key, which is shown only once, and its Trigger URL.
Send Content-Type: application/json and X-Webhook-Secret: <api-key>.

Trigger a query

The trigger returns 202 Accepted:
jobToken authorizes reading this job’s result for about one hour. workflowId is deprecated. Poll using the returned URL and bearer token; do not put the token in a URL.

Polling for results

An expired token returns 403. Retriggering creates another job with a fresh token; it does not resume the old job.

Push destinations

To send results to Slack, add:
Omit slackThreadTs for a channel message. For an external endpoint, use webhookUrl instead:

Response payload

Macroscope POSTs this JSON to an external destination:
Slack destinations receive the agent’s response as a message.

URL allowlisting

A GitHub organization admin must add external destinations in Settings → Connections → Webhooks → Allowed External URLs. Destinations must be public HTTPS endpoints without embedded credentials. Private, loopback, link-local, and reserved addresses are rejected, including hostnames resolving to them at delivery time. Redirects are not followed: a 3xx is a delivery failure. Allowlist the final endpoint.

Error codes