Automating security alerts: webhooks vs REST or GraphQL API
Verdict: Use webhooks to react in near real time when a security alert event fires, such as dependabot_alert. Use the REST or GraphQL API to query and reconcile alert data on demand. Combine both for event-driven plus periodic bulk workflows.
| Criterion | Webhooks | REST or GraphQL API |
|---|---|---|
| Model | Event-driven push on alert events | Pull on demand |
| Best for | Near-real-time notifications, e.g. Slack on new critical alert | Bulk retrieval and periodic reconciliation |
| Example | Subscribe to the dependabot_alert event | Query the code scanning REST API into a dashboard |
| Use when | You must react as events occur | You need to poll or export alert data |
Rules
- Subscribe to the dependabot_alert webhook event to notify external systems when Dependabot alerts are created or change state.
- The code scanning REST API exposes alert data so external tools and dashboards can consume it programmatically.
- APIs and webhooks are the two mechanisms for programmatically ingesting and reacting to security alert data.
Traps
- Polling commit history does not surface Dependabot alert creation events.
- Branch protection rules gate merges; they do not deliver alert notifications.