# Firewall Webhook Event Types

## Event - Container Evaluation

Use the container evaluation webhook to receive notifications when Firewall evaluates a Docker container image pulled through a Nexus Repository docker proxy repository.

**Webhook Behavior**  
The container evaluation webhook fires each time a Docker container image is evaluated by Firewall. This webhook is only available for webhooks configured with the Firewall context.

**Example Container Evaluation Event Payload**  
```json
{
  "timestamp": "2026-04-20T10:30:00.000+00:00",
  "initiator": "admin",
  "id": "evaluation-event-id-123",
  "containerEvaluation": {
    "repository": {
      "id": "repo-internal-id",
      "publicId": "my-docker-proxy",
      "name": "My Docker Proxy",
      "organizationId": "org-id-abc"
    },
    "policyEvaluationId": "policy-eval-id-456",
    "stage": "proxy",
    "ownerId": "repo-internal-id",
    "evaluationDate": "2026-04-20T10:29:55.000+00:00",
    "affectedComponentCount": 12,
    "criticalComponentCount": 2,
    "severeComponentCount": 4,
    "moderateComponentCount": 6,
    "outcome": "fail",
    "reportId": "report-id-xyz",
    "isForLatestScan": true
  }
}
```

## Event - Firewall Violation Alert

Use the violation alert webhook to receive notifications when Repository Firewall quarantines a component because it violates a Firewall policy. You can use this webhook to integrate quarantine events with external alerting, ticketing, and automation systems.

**Configuration**  
Configure Violation Alert webhook notifications only through Repository Firewall.

To receive Violation Alert notifications:

1. Create a Firewall webhook and select _Violation Alert_ as the event type. For more information, see [Create Webhooks.](https://help.sonatype.com/en/create-webhooks.html "Create Webhooks")  
2. Open the Firewall policy for which you want to receive webhook notifications.
3. In the _Notifications_ section:

1. Select Webhook as the _Recipient Type_.
   2. Select the webhook you created.
   3. Click _Add_.

4. Save the policy configuration.

Violation Alert webhook notifications follow the same notification inheritance hierarchy as Firewall email notifications.

- Configure notifications at the appropriate owner level.
- Child owners inherit the notification configuration from the nearest configured ancestor unless it is overridden.
- Configure a custom notification to override the inherited configuration for the selected owner.

**Webhook Behavior**  
The violation alert webhook is triggered when a component transitions from not quarantined to quarantined because of a Firewall policy evaluation.

The webhook is generated only for the initial quarantine event.

The webhook is not generated when:
- An already quarantined component is evaluated again.
- Continuous monitoring detects additional policy changes.
- A quarantined component transitions to the fire stage.

Each webhook delivery includes information about:
- Repository information
- Firewall policy information
- Quarantined component information
- Quarantine status

**Example Violation Alert Event Payload**  
**Note**  
The payload header value for this event is:
```plaintext
x-nexus-webhook-id: iq:firewallPolicyAlert
```

```json
{
  "timestamp": "2026-06-29T09:09:39.240+00:00",
  "initiator": "admin",
  "repository": {
    "id": "a7933e6ceb324fe29799a184c4174df1",
    "publicId": "maven-central",
    "format": "maven2"
  },
  "policyAlerts": [
    {
      "policyId": "75342e264fd2438f80b960db9defd506",
      "policyName": "Security-Critical",
      "threatLevel": 10,
      "componentFacts": [
        {
          "hash": "5af35056b4d257e4b64b",
          "displayName": "log4j : log4j : 1.2.17",
          "componentIdentifier": {
            "format": "maven",
            "coordinates": {
              "artifactId": "log4j",
              "classifier": "",
              "extension": "jar",
              "groupId": "log4j",
              "version": "1.2.17"
            }
          },
          "pathNames": [
            "log4j/log4j/1.2.17/log4j-1.2.17.jar"
          ],
          "constraintFacts": [
            {
              "constraintName": "Critical risk CVSS score",
              "satisfiedConditions": [
                {
                  "summary": "Security Vulnerability Severity >= 9",
                  "reason": "Found security vulnerability CVE-2019-17571 with severity >= 9 (severity = 9.8)"
                }
              ]
            }
          ]
        }
      ]
    },
    {
      "policyId": "75342e264fd2438f80b960db9defd506",
      "policyName": "Security-Critical",
      "threatLevel": 10,
      "componentFacts": [
        {
          "hash": "5af35056b4d257e4b64b",
          "displayName": "log4j : log4j : 1.2.17",
          "componentIdentifier": {
            "format": "maven",
            "coordinates": {
              "artifactId": "log4j",
              "classifier": "",
              "extension": "jar",
              "groupId": "log4j",
              "version": "1.2.17"
            }
          },
          "pathNames": [
            "log4j/log4j/1.2.17/log4j-1.2.17.jar"
          ],
          "constraintFacts": [
            {
              "constraintName": "Critical risk CVSS score",
              "satisfiedConditions": [
                {
                  "summary": "Security Vulnerability Severity >= 9",
                  "reason": "Found security vulnerability CVE-2022-23305 with severity >= 9 (severity = 9.8)"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "quarantineStatus": {
    "quarantined": true,
    "quarantineTime": "2026-06-29T09:09:39.180+00:00"
  }
}
```

## Event - Firewall Waiver Request

Use the waiver request webhook to receive notifications when a user requests a waiver for a quarantined component. You can use this webhook to integrate waiver requests with external approval and notification workflows.

**Webhook Behavior**  
The waiver request webhook is triggered whenever a user submits a waiver request for a quarantined component.

**Note**  
Firewall Waiver Request webhooks are supported for Nexus Repository Manager proxy-stage evaluation. Firewall Enterprise integrations for Artifactory and Cloudsmith are not covered by this event.

Each webhook delivery includes information about:
- The requester
- The waiver request comment
- The associated Firewall policy violation
- Links to review and process the waiver request

**Example Waiver Request Event Payload**  
**Note**  
The payload header value for this event is:
```plaintext
x-nexus-webhook-id: iq:firewallWaiverRequest
```

```json
{
  "timestamp": "2026-06-29T09:27:33.935+00:00",
  "initiator": "admin",
  "comment": "jj",
  "policyViolationId": "a7eea80e1ed84fa7ab9794d23ba52eab",
  "policyViolationLink": "http://localhost:8072/...",
  "addWaiverLink": "http://localhost:8072/...",
  "reviewWaiverRequestLink": "http://localhost:8072/...",
  "reasonId": "9b704ef5bc064fc29d7fe08a251ee9a6",
  "reasonText": "Acknowledged violation"
}
```

## Event - Organization and Repository Management

Use the organization and repository management webhook to receive notifications when repository management changes occur. The webhook is also triggered once when it is created for the first time.

The payload for this webhook includes repository manager and repository-level fields so the event reflects the firewall-specific context.

This webhook can notify external systems when repository management actions occur, including:
- **Create**  
When a repository management entry is created, a webhook is triggered.
- **Edit**  
When a repository management entry is updated, a webhook is triggered.
For example, if the name is changed, the webhook reflects the updated name.
- **Delete**  
When a repository is deleted, a webhook is triggered.
The resulting event reflects the repository state after the deletion.

**Example Organization and Repository Management Event Payload**
```json
{
  "timestamp": "2026-04-20T10:30:00.000+00:00",
  "initiator": "admin",
  "repositoryManagers": [
    {
      "id": "rm-internal-id",
      "instanceId": "nxrm-instance-001",
      "name": "My Nexus Instance",
      "productName": "Nexus",
      "productVersion": "3.70.0",
      "baseUrl": "http://nexus.example.com:8013",
      "configured": true
    }
  ],
  "repositories": [
    {
      "id": "repo-id-001",
      "publicId": "npm-proxy",
      "repositoryManagerId": "rm-internal-id",
      "format": "npm",
      "repositoryType": "proxy",
      "auditEnabled": true,
      "quarantineEnabled": true
    },
    {
      "id": "repo-id-002",
      "publicId": "maven-central",
      "repositoryManagerId": "rm-internal-id",
      "format": "maven2",
      "repositoryType": "proxy",
      "auditEnabled": false,
      "quarantineEnabled": false
    }
  ]
}
```

## Event - Waiver Expiration

Use the waiver expiration webhook to receive notifications when waiver expiration conditions are detected for the tenant where the webhook is configured.

**Webhook Behavior**  
The waiver expiration webhook is tenant-specific. A webhook configured for one tenant only receives waiver expiration events for that tenant.

Notifications are generated for waivers that are:
- expiring in 24 hours
- expiring in 7 days

**Tenant Scope**  
Each tenant manages its own webhook configuration and receives its own waiver expiration events. To receive notifications for multiple tenants, configure a webhook for each tenant.

**Event Behavior**  
When waiver expiration processing runs, webhook deliveries reflect the waiver expiration condition for the tenant.

The webhook can indicate statuses such as:
- expiring in 24 hours
- expiring in 7 days

**Example Waiver Expiration Event Payload - Expiring in 24 Hours**
```json
{
  "timestamp": "2026-04-20T10:30:00.000+00:00",
  "initiator": "SYSTEM",
  "eventType": "iq:waiverExpiration",
  "application": {
    "id": "app-internal-id"
  },
  "component": {
    "packageUrl": "pkg:npm/lodash@4.17.4",
    "format": "npm",
    "displayName": "lodash@4.17.4"
  },
  "policy": {
    "id": "policy-id-def",
    "name": "Integrity-Rating",
    "threatLevel": 9
  },
  "waiver": {
    "id": "waiver-id-abc",
    "expirationDate": "2026-04-21T23:59:59.999+00:00",
    "comment": "",
    "creatorUsername": "jsmith"
  },
  "status": "EXPIRING_IN_24_HOURS"
}
```

**Example Waiver Expiration Event Payload - Expiring in 7 Days**
```json
{
  "timestamp": "2026-04-20T10:30:00.000+00:00",
  "initiator": "SYSTEM",
  "eventType": "iq:waiverExpiration",
  "application": {
    "id": "ROOT_ORGANIZATION_ID"
  },
  "component": {
    "packageUrl": "pkg:maven/org.example/library@1.2.3",
    "format": "maven2",
    "displayName": "org.example:library:1.2.3"
  },
  "policy": {
    "id": "policy-id-abc",
    "name": "Security-Medium",
    "threatLevel": 7
  },
  "waiver": {
    "id": "waiver-id-xyz",
    "expirationDate": "2026-04-27T23:59:59.999+00:00",
    "comment": "Temporary waiver pending vendor fix",
    "creatorUsername": "jsmith"
  },
  "status": "EXPIRING_IN_7_DAYS"
}
```