Skip to content
Olympusx AIOlympusx AIOlympusx AI documentation

Webhooks

Olympusx AI accepts two kinds of inbound webhook: merge request events from a code host, which start a review, and alerts from your alerting system, which open a Security investigation. Both are turned on per source in the console, both are authenticated with a secret shown once, and both arrive at the console host.

Webhook Address Authentication Set up in
Merge request review https://<your-console-host>/api/v1/hooks/code-sources/<source-id> The host’s own signature or token header Merge request review
Alert intake https://<your-console-host>/api/v1/hooks/log-sources/<source-id> Authorization: Bearer <secret> Alert integration

The address and the secret are shown in the console when the webhook is turned on. The secret is shown only then; if it is lost, replace it and give the new one to the sender. Turning the webhook off drops the secret, and deliveries are then answered 404.

Your code host or alerting system must be able to reach the console host. If the console is published only inside your network, so must they be.

Merge request review

Section titled “Merge request review”

Turned on per code source by a tenant Admin, from the Code Assistant page.

Authentication

Section titled “Authentication”

Each host proves a delivery with its own mechanism, checked against the source’s secret:

Host Header Check
GitLab X-Gitlab-Token Must equal the secret.
GitHub X-Hub-Signature-256 sha256= and the HMAC-SHA256 of the body under the secret.
Bitbucket Cloud X-Hub-Signature sha256= and the HMAC-SHA256 of the body under the secret.

What starts a review

Section titled “What starts a review”

A merge request (a pull request on GitHub and Bitbucket) opened, reopened, or given new commits, in a repository the source indexes. Drafts, other actions and other events are acknowledged and ignored. A repeated delivery for the same commit does not start a second review. The full list of actions per host is on Merge request review.

Answers

Section titled “Answers”
Status Meaning
202 A review started; the body holds its reviewId. Or the event was acknowledged and ignored; the body says ignored and why.
200 A test delivery (ping), or a repeat of a delivery already reviewed ("duplicate": true with the existing reviewId).
400 not_an_event The body is not an event Olympusx AI reads.
401 bad_signature The delivery does not carry this webhook’s secret.
404 not_found No webhook at this address, or it was turned off.
413 too_large The body is over 2 MiB.
503 The platform’s secret store is not configured, or the platform cannot take the delivery now. The host retries.

Alert intake

Section titled “Alert intake”

Turned on per log source by a tenant Admin, from the Security page, with the model that investigates the source’s alerts.

Authentication

Section titled “Authentication”
Authorization: Bearer <secret>

Alertmanager sends this with an authorization block in its receiver’s http_config. Any SIEM that can post JSON with a bearer token can send alerts.

Body

Section titled “Body”

Either Alertmanager’s webhook body, of which only alerts with status firing are read, or one alert of this shape:

{
  "title": "Port scan from 10.0.4.17",
  "description": "More than 500 ports probed in 2 minutes",
  "time": "2026-11-02T08:14:00Z",
  "id": "rule-4411-10.0.4.17"
}

Only title is required. An alert’s text is treated as data: it is quoted into the investigation’s question and never followed as an instruction.

What it does

Section titled “What it does”

Each firing alert opens one investigation of that log source, over the window from 2 hours before the alert to 30 minutes after it. One delivery opens at most 5. A repeat of an alert already seen opens nothing.

Answers

Section titled “Answers”
Status Meaning
202 Investigations opened. The body lists their ids under investigations, and how many alerts were repeats under repeated.
200 Accepted; every alert was resolved or a repeat, so nothing was opened.
400 not_an_alert The body is neither shape above.
401 bad_token The bearer token is not this source’s secret.
404 not_found No webhook at this address, or alerts were turned off.
409 model_unavailable The model chosen for alerts can no longer be used by the tenant.
413 too_large The body is over 1 MiB.
Section titled “Related”