API & Integrations

FortWatch ships with native integrations for Slack, Microsoft Teams, Jira, PagerDuty, and GitHub. Slack and Teams receive real-time alerts and scan summaries in channels you choose. Jira and GitHub create tickets from findings and sync status back to FortWatch. PagerDuty escalates critical findings to your on-call rotation. Anything not on the native list connects through webhooks or the REST API.

Webhooks deliver JSON payloads over HTTPS POST to any endpoint you configure. Each payload includes an event type (scan.completed, finding.created, issue.assigned, asset.discovered, etc.), a workspace ID, an ISO-8601 timestamp, and a full resource object with severity, asset, and remediation metadata. Payloads are signed with HMAC-SHA256 so your receiver can verify authenticity before processing.

FortWatch uses token-based authentication with scoped API keys. Admins mint keys from the workspace settings page and assign read, write, or admin scopes per key. Keys are sent as a Bearer token in the Authorization header. Keys can be rotated, revoked, or regenerated at any time, and every API call is recorded in the audit log with the key name, actor, and outcome.

Yes. The API is rate-limited per API key to protect shared infrastructure: 120 requests per minute for read operations and 60 per minute for write operations on most endpoints. Rate-limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) are returned on every response so clients can back off gracefully. Enterprise plans lift the limits.

Slack alerts arrive as formatted messages with a severity-colored sidebar (red for critical, orange for high, yellow for medium, blue for low), the finding title, affected asset, short remediation summary, and a direct link back to the full issue in FortWatch. You can route alerts to different channels by severity, asset tag, or scan type — critical findings to #security-oncall, weekly summaries to #engineering, and so on.

Yes. Configure the Jira integration once with your project key and issue type, and any new finding above a severity threshold you choose creates a Jira ticket with the finding's title, description, severity, affected asset, and remediation steps prefilled. Status flows both ways: closing the Jira ticket marks the FortWatch issue resolved, and resolving the finding in FortWatch comments back to the ticket.

Yes. FortWatch sends structured JSON events to any SIEM that accepts HTTP inputs — Splunk HEC, Elastic, Datadog, Microsoft Sentinel, Sumo Logic, and generic syslog collectors via an intermediate gateway. Events include the full finding object so your SIEM can correlate FortWatch detections with logs from your WAF, endpoint, or cloud providers. We publish CEF and ECS mapping guides for common platforms.

The full OpenAPI 3.1 specification is published at docs.fortwatch.ai/api with live request/response examples, authentication walkthroughs, and code snippets for curl, Node.js, Python, and Go. A sandbox environment is available on every plan so you can build and test integrations against synthetic data before pointing your automation at production.