API, personal tokens and webhooks

Summary

With a personal access token your scripts can use the RECON API; with integrations you receive scan events in your own tools. In this lesson Luca creates a read-only token for a SIEM integration, tries an API call and sees how to add a webhook.

Chapters

Key points

• Tokens are created in Settings, API & Integrations, under Personal access tokens, with Generate token.
• A new token starts with the Scans (read) scope and a 90 days expiry. The value is shown only once: copy it and click I've stored it safely. The table keeps only its prefix.
• The token is not a Cyber Token: it is a credential, like a password.
• Documentation shows an example call and the OpenAPI specification, with endpoints for scans, vulnerabilities, assets and probes. The token goes in the Authorization header after the word Bearer; RECON answers in JSON.
• To receive events, open Integrations and click Add integration. The available types are Generic Webhook, Slack, Email Digest, Jira, ServiceNow, Splunk HEC and Microsoft Sentinel.
• For a Generic Webhook you enter the receiver URL, which must be a public HTTPS address, and the Events to forward: Scan completed, Scan failed, Scan deleted.
• When the integration is created, RECON shows the Signing secret once: your receiver uses it to verify the HMAC-SHA256 signature in the X-Orizon-Signature header of every generic webhook delivery.
• Test sends a test event; Deliveries shows the 50 most recent deliveries, and Redeliver retries a failed one. You can have up to 50 integrations.

Transcript

The full transcript of the video (in Italian) is in the player's Transcript tab.

Related articles