Webhooks

TapPass has two outbound webhook paths: the SIEM export (stream the audit trail to any HTTP endpoint) and the alerting webhook (real-time notifications on governance events). Use them for any system that doesn’t have a native exporter (Datadog, Elastic, PagerDuty, a custom bus, …).

SIEM export to a generic webhook

Via environment:

TAPPASS_SIEM_URL=https://siem-bridge.example.com/tappass
TAPPASS_SIEM_DESTINATION=webhook
TAPPASS_SIEM_AUTH_TOKEN=<shared-secret>

Or via the settings API (PUT /api/settings/siem):

{
  "enabled": true,
  "destination": "webhook",
  "url": "https://siem-bridge.example.com/tappass",
  "auth_token": "<shared-secret>",
  "format": "json",
  "severity_filter": "detection",
  "event_types": [],
  "exclude_event_types": []
}

Options:

• Format — json (raw TapPass JSON), cef, or ocsf.
• Filtering — severity_filter (all | detection | action | block) plus event_types / exclude_event_types.
• Buffering — buffer_size, flush_interval_seconds, max_retries, retry_backoff_seconds control batching and delivery retries.
• Metadata — source_name and environment are attached to every exported event.

The destination URL is validated against SSRF — loopback, link-local, and cloud metadata addresses are rejected.

Alerting webhook (Slack / Teams / generic)

Separate from the export pipeline: fires when governance events occur, never blocks the request path.

TAPPASS_ALERT_WEBHOOK_URL=https://hooks.slack.com/services/T.../B.../xxx
TAPPASS_ALERT_WEBHOOK_TYPE=slack        # slack | teams | generic
TAPPASS_ALERT_MIN_SEVERITY=block        # block | detect | all

Runtime configuration via the settings API:

• GET /api/settings/alerting — current configuration
• PUT /api/settings/alerting — update
• POST /api/settings/alerting/test — send a test message
• GET /api/settings/alerting/delivery-log — recent delivery outcomes

Slack and Teams get natively-formatted messages; generic posts the raw event JSON.

Validate

curl -X POST https://tappass.example.com/api/settings/siem/test \
  -H "Authorization: Bearer $ADMIN_KEY"

curl -X POST https://tappass.example.com/api/settings/alerting/test \
  -H "Authorization: Bearer $ADMIN_KEY"