---
title: "cURL deploy hook"
description: "Call the Rookflare deploy hook with one cURL command from any CI, deploy script or host. Request format, responses, limits and troubleshooting."
url: "https://rookflare.com/integrations/curl/"
---

# cURL deploy hook

Any CI, deploy script or host that can send an HTTP request can start a Rookflare scan. This is the request, what it returns and the limits.

## What the cURL integration does

### What it does

- Starts a scan of the website as soon as your deploy finishes, with every check of a normal scan: desktop and mobile screenshots compared with your approved baseline, server and JavaScript errors, broken images and search settings.
- Accepts the token as a Bearer header or, for tools that only call a URL, as a ?token= query parameter.
- Repeated calls for the same deploy start only one scan, and a deploy that lands while a scan runs joins that scan.

### Before you start

- A Growth and Agency plan. The 14-day free trial runs on Growth, so you can set it up before you pay.
- A verified website in Rookflare with monitoring turned on, and the owner or admin role.
- A deploy script or CI job that can run curl, or any tool that can send a POST request.

## Set up cURL step by step

### 1. Create the deploy hook in Rookflare

Open the website, go to the Settings tab and select “Create deploy hook” in the “Scan after deploy” card. Copy the token right away: this is the only time Rookflare shows it in full. The card keeps the endpoint and the last four characters of the token.

### 2. Send the request after your deploy

POST to the endpoint with the token in the Authorization header. The body is optional; send the commit or release as ref so repeated calls start one scan. Rookflare also reads sha and commit_ref. A ref may use letters, digits and . - _ / : @ + #; Rookflare keeps the first 120 characters and ignores a ref it cannot use.

```bash
curl -X POST "https://app.rookflare.example/api/webhooks/deploy" \
  -H "Authorization: Bearer YOUR_DEPLOY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ref": "v1.2.3"}'
```

### 3. Or put the token in the URL

For tools that cannot set headers. The header wins when both are present.

```bash
curl -X POST "https://app.rookflare.example/api/webhooks/deploy?token=YOUR_DEPLOY_TOKEN"
```

### 4. Read the response

Rookflare answers 202 Accepted with the scan’s id and status. “created” is true for a new scan and false when the call joined a running scan or matched a ref from the last 24 hours. Errors use the problem+json format with a code and a trace_id.

```json
{
  "data": {
    "scan_id": "0b6f6c1e-4d4b-4f7e-9a51-2f0d3c8e7a10",
    "status": "queued",
    "created": true
  }
}
```

### 5. Test it by hand, then from your deploy

Run the command once from your terminal and check for the 202 answer, then add it to your deploy. In Rookflare, the card’s “Last used” changes to the time of the call and the website’s Scan history shows a scan with the trigger “After deploy”.

Sample endpoint and placeholder token. The dashboard fills in yours.

## If it does not work

### 401 Unauthenticated

The token is missing, mistyped, rotated or revoked. Rookflare gives the same answer in every case so tokens cannot be guessed. Copy the token again after rotating it, check the secret name and make sure the header reads “Authorization: Bearer pgd_…”.

### 402 Not available on your plan, or plan limit reached

Deploy hooks need Growth and Agency. Deploy scans also count towards your on-demand scans: Growth allows 10 on-demand scans a day per organization and Agency 30. When they are used up, the response carries a Retry-After header with the time until the limit resets at midnight UTC.

### 409 Conflict

The website is not verified yet, or its monitoring is paused. Verify the domain or resume monitoring on the website page, then deploy again.

### 429 Too many requests

The deploy endpoint accepts 30 requests a minute from one address. Call it once per deploy, after the deploy step, not in a loop or once per file.

### Two deploys, one scan

This is on purpose. Calls with the same ref within 24 hours return the scan that ref already started, and a call while a scan is running joins that scan. The response says “created”: false in both cases.

## cURL integration questions

### Where should the deploy token live?

In your deploy tool’s secret store, never in the repository. The token can only start scans of one website, and you can rotate or revoke it on the website’s Settings tab at any time; the old token stops working right away.

### Do deploy scans count towards a limit?

Yes. They count as on-demand scans. Growth allows 10 on-demand scans a day per organization and Agency 30. Scheduled scans are separate and keep running as usual.

### Should a failed call fail my deploy?

That is your choice. With curl -f the command exits with an error on any 4xx or 5xx answer, which makes a wrong token visible in CI. Leave -f out if the deploy should pass anyway.

### How do I report a failed call?

Every error answer includes a trace_id. Send it to us through the contact page with the time of the call; never send the token itself.

## Related integrations

- [GitHub Actions integration](https://rookflare.com/integrations/github-actions/)
- [GitLab CI/CD integration](https://rookflare.com/integrations/gitlab-ci/)
- [WordPress integration](https://rookflare.com/integrations/wordpress/)

[Start the free trial](https://app.rookflare.com/register/).