Nexus Webhooks

generated: '2026-11-05'
method: searched
source:
- https://help.sonatype.com/en/webhooks.html
- https://help.sonatype.com/en/enabling-a-global-webhook-capability.html
- https://help.sonatype.com/en/enabling-a-repository-webhook-capability.html
name: Sonatype Nexus Repository webhooks
description: 'Nexus Repository webhooks are HTTP callbacks configured as Capabilities (Webhook: Global, Webhook: Repository)
  by an administrator; each capability selects Event Types and a target URL. Payloads are JSON POSTs, optionally signed with
  a shared secret. The REST contract exposes no webhook-management operations; configuration is through the Capabilities UI
  or the Capabilities API.'
docs: https://help.sonatype.com/en/webhooks.html
format: json
delivery:
  method: POST
  content_type: application/json
  signature:
    header: X-Nexus-Webhook-Signature
    algorithm: HMAC-SHA1 of the JSON body (hashed without whitespace) using the capability's Secret Key
    quote: Webhooks will provide a sha1 hash of the JSON body using a shared secret key. This allows you to verify the data
      integrity as well as its authenticity. The JSON body is hashed without whitespace and this hash is provided in the header
      as X-Nexus-Webhook-Signature.
  retries: null
  retries_note: No retry or redelivery policy is documented.
capabilities:
- type: 'Webhook: Global'
  scope: instance-wide
  docs: https://help.sonatype.com/en/enabling-a-global-webhook-capability.html
  note: '"A Global: Webhook capability for Event Type audit requires that you also enable the Audit capability, in order for
    events to be fed to the webhook."'
- type: 'Webhook: Repository'
  scope: one selected repository
  docs: https://help.sonatype.com/en/enabling-a-repository-webhook-capability.html
events:
- name: audit
  scope: global
  description: Audit events; requires the Audit capability to be enabled.
  source: https://help.sonatype.com/en/enabling-a-global-webhook-capability.html
events_note: The current docs name the "audit" global event type explicitly; the remaining Event Types (repository, component
  and asset events) are chosen from the capability form and are not enumerated on the pages read. No AsyncAPI document is
  published.