Firewall Webhook Event Types

Event - Container Evaluation

Use the container evaluation webhook to receive notifications when Firewall evaluates a Docker container image pulled through a Nexus Repository docker proxy repository.

Webhook Behavior
The container evaluation webhook fires each time a Docker container image is evaluated by Firewall. This webhook is only available for webhooks configured with the Firewall context.

Example Container Evaluation Event Payload

{
  "timestamp": "2026-04-20T10:30:00.000+00:00",
  "initiator": "admin",
  "id": "evaluation-event-id-123",
  "containerEvaluation": {
    "repository": {
      "id": "repo-internal-id",
      "publicId": "my-docker-proxy",
      "name": "My Docker Proxy",
      "organizationId": "org-id-abc"
    },
    "policyEvaluationId": "policy-eval-id-456",
    "stage": "proxy",
    "ownerId": "repo-internal-id",
    "evaluationDate": "2026-04-20T10:29:55.000+00:00",
    "affectedComponentCount": 12,
    "criticalComponentCount": 2,
    "severeComponentCount": 4,
    "moderateComponentCount": 6,
    "outcome": "fail",
    "reportId": "report-id-xyz",
    "isForLatestScan": true
  }
}

Event - Firewall Violation Alert

Use the violation alert webhook to receive notifications when Repository Firewall quarantines a component because it violates a Firewall policy. You can use this webhook to integrate quarantine events with external alerting, ticketing, and automation systems.

Configuration
Configure Violation Alert webhook notifications only through Repository Firewall.

To receive Violation Alert notifications:

Create a Firewall webhook and select Violation Alert as the event type. For more information, see Create Webhooks.
Open the Firewall policy for which you want to receive webhook notifications.
In the Notifications section:
Select Webhook as the Recipient Type.
1. Select the webhook you created.
2. Click Add.
Save the policy configuration.

Violation Alert webhook notifications follow the same notification inheritance hierarchy as Firewall email notifications.

Configure notifications at the appropriate owner level.
Child owners inherit the notification configuration from the nearest configured ancestor unless it is overridden.
Configure a custom notification to override the inherited configuration for the selected owner.

Webhook Behavior
The violation alert webhook is triggered when a component transitions from not quarantined to quarantined because of a Firewall policy evaluation.

The webhook is generated only for the initial quarantine event.

The webhook is not generated when:

An already quarantined component is evaluated again.
Continuous monitoring detects additional policy changes.
A quarantined component transitions to the fire stage.

Each webhook delivery includes information about:

Repository information
Firewall policy information
Quarantined component information
Quarantine status

Example Violation Alert Event Payload
Note
The payload header value for this event is:

x-nexus-webhook-id: iq:firewallPolicyAlert

{
  "timestamp": "2026-06-29T09:09:39.240+00:00",
  "initiator": "admin",
  "repository": {
    "id": "a7933e6ceb324fe29799a184c4174df1",
    "publicId": "maven-central",
    "format": "maven2"
  },
  "policyAlerts": [
    {
      "policyId": "75342e264fd2438f80b960db9defd506",
      "policyName": "Security-Critical",
      "threatLevel": 10,
      "componentFacts": [
        {
          "hash": "5af35056b4d257e4b64b",
          "displayName": "log4j : log4j : 1.2.17",
          "componentIdentifier": {
            "format": "maven",
            "coordinates": {
              "artifactId": "log4j",
              "classifier": "",
              "extension": "jar",
              "groupId": "log4j",
              "version": "1.2.17"
            }
          },
          "pathNames": [
            "log4j/log4j/1.2.17/log4j-1.2.17.jar"
          ],
          "constraintFacts": [
            {
              "constraintName": "Critical risk CVSS score",
              "satisfiedConditions": [
                {
                  "summary": "Security Vulnerability Severity >= 9",
                  "reason": "Found security vulnerability CVE-2019-17571 with severity >= 9 (severity = 9.8)"
                }
              ]
            }
          ]
        }
      ]
    },
    {
      "policyId": "75342e264fd2438f80b960db9defd506",
      "policyName": "Security-Critical",
      "threatLevel": 10,
      "componentFacts": [
        {
          "hash": "5af35056b4d257e4b64b",
          "displayName": "log4j : log4j : 1.2.17",
          "componentIdentifier": {
            "format": "maven",
            "coordinates": {
              "artifactId": "log4j",
              "classifier": "",
              "extension": "jar",
              "groupId": "log4j",
              "version": "1.2.17"
            }
          },
          "pathNames": [
            "log4j/log4j/1.2.17/log4j-1.2.17.jar"
          ],
          "constraintFacts": [
            {
              "constraintName": "Critical risk CVSS score",
              "satisfiedConditions": [
                {
                  "summary": "Security Vulnerability Severity >= 9",
                  "reason": "Found security vulnerability CVE-2022-23305 with severity >= 9 (severity = 9.8)"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "quarantineStatus": {
    "quarantined": true,
    "quarantineTime": "2026-06-29T09:09:39.180+00:00"
  }
}

Event - Firewall Waiver Request

Use the waiver request webhook to receive notifications when a user requests a waiver for a quarantined component. You can use this webhook to integrate waiver requests with external approval and notification workflows.

Webhook Behavior
The waiver request webhook is triggered whenever a user submits a waiver request for a quarantined component.

Note
Firewall Waiver Request webhooks are supported for Nexus Repository Manager proxy-stage evaluation. Firewall Enterprise integrations for Artifactory and Cloudsmith are not covered by this event.

Each webhook delivery includes information about:

The requester
The waiver request comment
The associated Firewall policy violation
Links to review and process the waiver request

Example Waiver Request Event Payload
Note
The payload header value for this event is:

x-nexus-webhook-id: iq:firewallWaiverRequest

{
  "timestamp": "2026-06-29T09:27:33.935+00:00",
  "initiator": "admin",
  "comment": "jj",
  "policyViolationId": "a7eea80e1ed84fa7ab9794d23ba52eab",
  "policyViolationLink": "http://localhost:8072/...",
  "addWaiverLink": "http://localhost:8072/...",
  "reviewWaiverRequestLink": "http://localhost:8072/...",
  "reasonId": "9b704ef5bc064fc29d7fe08a251ee9a6",
  "reasonText": "Acknowledged violation"
}

Event - Organization and Repository Management

Use the organization and repository management webhook to receive notifications when repository management changes occur. The webhook is also triggered once when it is created for the first time.

The payload for this webhook includes repository manager and repository-level fields so the event reflects the firewall-specific context.

This webhook can notify external systems when repository management actions occur, including:

Create
When a repository management entry is created, a webhook is triggered.
Edit
When a repository management entry is updated, a webhook is triggered. For example, if the name is changed, the webhook reflects the updated name.
Delete
When a repository is deleted, a webhook is triggered. The resulting event reflects the repository state after the deletion.

Example Organization and Repository Management Event Payload

{
  "timestamp": "2026-04-20T10:30:00.000+00:00",
  "initiator": "admin",
  "repositoryManagers": [
    {
      "id": "rm-internal-id",
      "instanceId": "nxrm-instance-001",
      "name": "My Nexus Instance",
      "productName": "Nexus",
      "productVersion": "3.70.0",
      "baseUrl": "http://nexus.example.com:8013",
      "configured": true
    }
  ],
  "repositories": [
    {
      "id": "repo-id-001",
      "publicId": "npm-proxy",
      "repositoryManagerId": "rm-internal-id",
      "format": "npm",
      "repositoryType": "proxy",
      "auditEnabled": true,
      "quarantineEnabled": true
    },
    {
      "id": "repo-id-002",
      "publicId": "maven-central",
      "repositoryManagerId": "rm-internal-id",
      "format": "maven2",
      "repositoryType": "proxy",
      "auditEnabled": false,
      "quarantineEnabled": false
    }
  ]
}

Event - Waiver Expiration

Use the waiver expiration webhook to receive notifications when waiver expiration conditions are detected for the tenant where the webhook is configured.

Webhook Behavior
The waiver expiration webhook is tenant-specific. A webhook configured for one tenant only receives waiver expiration events for that tenant.

Notifications are generated for waivers that are:

expiring in 24 hours
expiring in 7 days

Tenant Scope
Each tenant manages its own webhook configuration and receives its own waiver expiration events. To receive notifications for multiple tenants, configure a webhook for each tenant.

Event Behavior
When waiver expiration processing runs, webhook deliveries reflect the waiver expiration condition for the tenant.

The webhook can indicate statuses such as:

expiring in 24 hours
expiring in 7 days

Example Waiver Expiration Event Payload - Expiring in 24 Hours

{
  "timestamp": "2026-04-20T10:30:00.000+00:00",
  "initiator": "SYSTEM",
  "eventType": "iq:waiverExpiration",
  "application": {
    "id": "app-internal-id"
  },
  "component": {
    "packageUrl": "pkg:npm/lodash@4.17.4",
    "format": "npm",
    "displayName": "lodash@4.17.4"
  },
  "policy": {
    "id": "policy-id-def",
    "name": "Integrity-Rating",
    "threatLevel": 9
  },
  "waiver": {
    "id": "waiver-id-abc",
    "expirationDate": "2026-04-21T23:59:59.999+00:00",
    "comment": "",
    "creatorUsername": "jsmith"
  },
  "status": "EXPIRING_IN_24_HOURS"
}

Example Waiver Expiration Event Payload - Expiring in 7 Days

{
  "timestamp": "2026-04-20T10:30:00.000+00:00",
  "initiator": "SYSTEM",
  "eventType": "iq:waiverExpiration",
  "application": {
    "id": "ROOT_ORGANIZATION_ID"
  },
  "component": {
    "packageUrl": "pkg:maven/org.example/library@1.2.3",
    "format": "maven2",
    "displayName": "org.example:library:1.2.3"
  },
  "policy": {
    "id": "policy-id-abc",
    "name": "Security-Medium",
    "threatLevel": 7
  },
  "waiver": {
    "id": "waiver-id-xyz",
    "expirationDate": "2026-04-27T23:59:59.999+00:00",
    "comment": "Temporary waiver pending vendor fix",
    "creatorUsername": "jsmith"
  },
  "status": "EXPIRING_IN_7_DAYS"
}