Scan after deploy
GitHub Actions
Start a scan from your workflow after each deploy.
Integration guide
Start a website scan from any CI or host with cURL
Any CI, deploy script or host that can send an HTTP request can start a Rookflare scan. This is the request, what it returns and the limits.
Overview
What the cURL integration does
What it does
- Starts a scan of the website as soon as your deploy finishes, with every check of a normal scan: desktop and mobile screenshots compared with your approved baseline, server and JavaScript errors, broken images and search settings.
- Accepts the token as a Bearer header or, for tools that only call a URL, as a ?token= query parameter.
- Repeated calls for the same deploy start only one scan, and a deploy that lands while a scan runs joins that scan.
Before you start
- A Growth and Agency plan. The 14-day free trial runs on Growth, so you can set it up before you pay.
- A verified website in Rookflare with monitoring turned on, and the owner or admin role.
- A deploy script or CI job that can run curl, or any tool that can send a POST request.
Setup
Set up cURL step by step
-
Step 1
Create the deploy hook in Rookflare
Open the website, go to the Settings tab and select “Create deploy hook” in the “Scan after deploy” card. Copy the token right away: this is the only time Rookflare shows it in full. The card keeps the endpoint and the last four characters of the token.
The Scan after deploy card right after “Create deploy hook”: the full token is shown once, with the endpoint below it. -
Step 2
Send the request after your deploy
POST to the endpoint with the token in the Authorization header. The body is optional; send the commit or release as ref so repeated calls start one scan. Rookflare also reads sha and commit_ref. A ref may use letters, digits and . - _ / : @ + #; Rookflare keeps the first 120 characters and ignores a ref it cannot use.
curl -X POST "https://app.rookflare.example/api/webhooks/deploy" \ -H "Authorization: Bearer YOUR_DEPLOY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"ref": "v1.2.3"}'Sample endpoint and placeholder token. The dashboard fills in yours.
-
Step 3
Or put the token in the URL
For tools that cannot set headers. The header wins when both are present.
curl -X POST "https://app.rookflare.example/api/webhooks/deploy?token=YOUR_DEPLOY_TOKEN"Sample endpoint and placeholder token. The dashboard fills in yours.
-
Step 4
Read the response
Rookflare answers 202 Accepted with the scan’s id and status. “created” is true for a new scan and false when the call joined a running scan or matched a ref from the last 24 hours. Errors use the problem+json format with a code and a trace_id.
{ "data": { "scan_id": "0b6f6c1e-4d4b-4f7e-9a51-2f0d3c8e7a10", "status": "queued", "created": true } }Sample endpoint and placeholder token. The dashboard fills in yours.
-
Step 5
Test it by hand, then from your deploy
Run the command once from your terminal and check for the 202 answer, then add it to your deploy. In Rookflare, the card’s “Last used” changes to the time of the call and the website’s Scan history shows a scan with the trigger “After deploy”.
The website’s Scan history: the newest scan has the trigger “After deploy” and is scanning; below it a scheduled scan and an earlier deploy scan, both completed.
Troubleshooting
If it does not work
-
401 Unauthenticated
The token is missing, mistyped, rotated or revoked. Rookflare gives the same answer in every case so tokens cannot be guessed. Copy the token again after rotating it, check the secret name and make sure the header reads “Authorization: Bearer pgd_…”.
-
402 Not available on your plan, or plan limit reached
Deploy hooks need Growth and Agency. Deploy scans also count towards your on-demand scans: Growth allows 10 on-demand scans a day per organization and Agency 30. When they are used up, the response carries a Retry-After header with the time until the limit resets at midnight UTC.
-
409 Conflict
The website is not verified yet, or its monitoring is paused. Verify the domain or resume monitoring on the website page, then deploy again.
-
429 Too many requests
The deploy endpoint accepts 30 requests a minute from one address. Call it once per deploy, after the deploy step, not in a loop or once per file.
-
Two deploys, one scan
This is on purpose. Calls with the same ref within 24 hours return the scan that ref already started, and a call while a scan is running joins that scan. The response says “created”: false in both cases.
Where should the deploy token live?
In your deploy tool’s secret store, never in the repository. The token can only start scans of one website, and you can rotate or revoke it on the website’s Settings tab at any time; the old token stops working right away.
Do deploy scans count towards a limit?
Yes. They count as on-demand scans. Growth allows 10 on-demand scans a day per organization and Agency 30. Scheduled scans are separate and keep running as usual.
Should a failed call fail my deploy?
That is your choice. With curl -f the command exits with an error on any 4xx or 5xx answer, which makes a wrong token visible in CI. Leave -f out if the deploy should pass anyway.
How do I report a failed call?
Every error answer includes a trace_id. Send it to us through the contact page with the time of the call; never send the token itself.
Start monitoring your website
Add your address, pick the pages and approve the first scan as your baseline.
Plans start at €19 per month. Prices are provisional.