API keys + webhooks (Enterprise)

Programmatic access

Enterprise plans unlock the REST API + webhook system.

Creating an API key

/dashboard/api-keys → "Create key" → copy the smw_pk_live_<32-byte-random> token. Shown only once — store in your secret manager.

• Keys are hashed at rest (bcrypt)
• Last-4 characters shown in UI for identification
• Per-key scope (workspace-bound, role-bound, IP-bound)
• Rate limit: 100 requests/minute per key, 10,000/day total

Calling the API

curl -H "Authorization: Bearer smw_pk_live_..." \
     -H "Content-Type: application/json" \
     https://api.slapmyweb.com/v1/audits/<audit-id>

Full endpoint list: /api-docs (interactive Swagger UI).

Webhooks

/dashboard/webhooks → "Add endpoint" → paste your HTTPS URL. We POST signed JSON payloads on these events:

• audit.completed — when a scan finishes
• scheduled_report.sent — when a recurring report is delivered
• scheduled_report.bounced — when a recipient bounces
• share_link.created, share_link.viewed — share-link lifecycle
• workspace.member_invited, workspace.member_joined

HMAC signature

Every webhook includes X-Slapmyweb-Signature: t=<ts>,v1=<hex> where hex = HMAC-SHA256(<webhook-secret>, "<ts>.<raw-body>"). Verify in your handler with constant-time comparison. t is unix-timestamp; reject if older than 5 minutes (replay protection).