Scan after deploy
Vercel
A Vercel webhook that starts a scan per deployment.
Integration guide
Scan your website after every Netlify deploy
Add an outgoing webhook for “Deploy succeeded” in Netlify, and each production deploy starts a Rookflare scan of your website.
Overview
What the Netlify integration does
What it does
- Netlify’s HTTP POST deploy notification sends the deploy as JSON to Rookflare when the deploy succeeds.
- Rookflare reads commit_ref from that JSON and uses it as the ref, so a retried deploy of the same commit starts one scan.
- No build plugin and no change to netlify.toml; the notification lives in the project settings.
Before you start
- A Growth and Agency plan. The 14-day free trial runs on Growth, so you can set it up before you pay.
- A verified website in Rookflare with monitoring turned on, and the owner or admin role.
- A Netlify project that serves your website, and access to its Project configuration.
Setup
Set up Netlify step by step
-
Step 1
Create the deploy hook in Rookflare
Open the website, go to the Settings tab and select “Create deploy hook” in the “Scan after deploy” card. Copy the token right away: this is the only time Rookflare shows it in full. The card keeps the endpoint and the last four characters of the token.
The Scan after deploy card right after “Create deploy hook”: the full token is shown once, with the endpoint below it. -
Step 2
Copy the webhook URL
Netlify’s HTTP POST notification has no field for custom headers, so the token goes into the URL as a query parameter. Treat the whole URL as a secret.
https://app.rookflare.example/api/webhooks/deploy?token=YOUR_DEPLOY_TOKENSample endpoint and placeholder token. The dashboard fills in yours.
-
Step 3
Add the deploy notification in Netlify
In Netlify, open Project configuration → Notifications → Deploy notifications and add an “HTTP Post Request” notification. Pick the event “Deploy succeeded” and paste the URL. Netlify also offers a JWS secret token that signs each request in an X-Webhook-Signature header; Rookflare does not check it, so you can leave it empty.
-
Step 4
Trigger a deploy
On the project’s Deploys page, trigger a new deploy, or push to the production branch. When Netlify marks the deploy as published, “Last used” on the Rookflare card changes and the website’s Scan history shows a scan with the trigger “After deploy”.
The website’s Scan history: the newest scan has the trigger “After deploy” and is scanning; below it a scheduled scan and an earlier deploy scan, both completed.
Troubleshooting
If it does not work
-
Deploy previews and branch deploys start scans
If Netlify also sends the notification for deploy previews and branch deploys, each one starts or joins a scan of your live site, because Rookflare does not read the deploy context. To scan only after production deploys, use the build plugin approach in the questions below instead of the notification.
-
Manual deploys start a new scan each time
Deploys made by drag and drop or from the Netlify CLI without Git have no commit reference. Rookflare then has no ref to match, so each call starts a scan unless one is already running.
-
Calls stopped working after you rotated the token
Edit the notification in Deploy notifications and paste the new URL from the Rookflare card. The old token stops working the moment you rotate it.
-
Rookflare answers with an error code
401 means a wrong, rotated or revoked token, 402 a plan or daily limit, 409 an unverified or paused website and 429 more than 30 calls a minute. The cURL guide explains each answer and what to do.
Can I start scans only for production deploys?
Yes, with a small local build plugin instead of the notification. Its onSuccess handler runs when the deploy succeeds and can send the cURL request with the COMMIT_REF environment variable as the ref. Register it under [[context.production.plugins]] in netlify.toml so it runs only in the production context, and keep the token in a Netlify environment variable.
Which of Netlify’s other deploy events should I use?
Only “Deploy succeeded”. “Deploy started” fires before your new version is live, so a scan would see the old one, and failed deploys change nothing on your site.
We have several Netlify projects from one repository.
Each Netlify project has its own notifications. Add the notification only to the project that serves the website you monitor, with that website’s token in the URL.
Start monitoring your website
Add your address, pick the pages and approve the first scan as your baseline.
Plans start at €19 per month. Prices are provisional.