API & integrations

FortWatch ships with native integrations for Slack, Microsoft Teams, Jira, PagerDuty, and GitHub. Slack and Teams receive real-time alerts and scan summaries in channels you choose. Jira and GitHub create tickets from findings and sync status back to FortWatch. PagerDuty escalates critical findings to your on-call rotation. Anything not on the native list connects through webhooks or the REST API.

Webhooks deliver JSON payloads over HTTPS POST to any endpoint you configure. Each payload includes an event type (scan.completed, finding.created, issue.assigned, asset.discovered, etc.), a workspace ID, an ISO-8601 timestamp, and a full resource object with severity, asset, and remediation metadata. Payloads are signed with HMAC-SHA256 so your receiver can verify authenticity before processing.

With API keys or OAuth apps, on every plan. Owners and admins create keys in Settings → API access, with a code from their authenticator app, and give each key read or read-and-write access per area: assets, scans, issues, reports and the audit log. Every key expires (30 days, 90 days or a year) and can be revoked at any time. Keys are sent as a Bearer token in the Authorization header. Other products connect through OAuth 2.1 with a consent screen. Every change made through a key or an app appears in the audit log under its name.

Yes. Each API key or OAuth connection may send 120 read requests and 60 write requests a minute, and a few heavy operations (discovery runs, assessment reports, audit exports) also have an hourly budget per workspace. Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers, and a request over the limit gets a 429 with Retry-After, so clients can back off gracefully.

Slack alerts arrive as formatted messages with a severity-colored sidebar (red for critical, orange for high, yellow for medium, blue for low), the finding title, affected asset, short remediation summary, and a direct link back to the full issue in FortWatch. You can route alerts to different channels by severity, asset tag, or scan type — critical findings to #security-oncall, weekly summaries to #engineering, and so on.

Yes. Configure the Jira integration once with your project key and issue type, and any new finding above a severity threshold you choose creates a Jira ticket with the finding's title, description, severity, affected asset, and remediation steps prefilled. Status flows both ways: closing the Jira ticket marks the FortWatch issue resolved, and resolving the finding in FortWatch comments back to the ticket.

Yes. FortWatch sends structured JSON events to any SIEM that accepts HTTP inputs — Splunk HEC, Elastic, Datadog, Microsoft Sentinel, Sumo Logic, and generic syslog collectors via an intermediate gateway. Events include the full finding object so your SIEM can correlate FortWatch detections with logs from your WAF, endpoint, or cloud providers. We publish CEF and ECS mapping guides for common platforms.

At docs.fortwatch.ai: a page for every endpoint with its parameters, responses and examples in curl, Node.js, Python and Go, guides for API keys, OAuth and limits, the OpenAPI document, and every page as Markdown for AI tools. To test safely, give a key read-only access.