Add webhook event for compliance control status changes
Release notes
Add a compliance_control_status_changed webhook event that fires when a compliance control status changes (e.g., from pass to fail). This enables real-time alerting when projects fall out of compliance, without requiring API polling.
Problem to solve
Organizations using Compliance Frameworks need to know immediately when a project falls out of compliance. Currently:
- No webhook event for compliance status changes (webhook events list has no compliance events)
- No audit event for control status transitions (audit event types covers framework changes but not status changes)
- No notification setting in Compliance Center
Customer feedback:
"Is there any kind of alerting when a Control Status goes from Pass to Fail?"
The only workaround is polling the GraphQL API (project.complianceControlStatus) on a schedule and comparing values between polls. This is inefficient and adds latency to compliance response.
Proposal
Add a compliance_control_status_changed webhook event with payload:
{
"object_kind": "compliance_control_status",
"event_type": "compliance_control_status_changed",
"project": { "id": 123, "path_with_namespace": "group/project" },
"control": {
"id": 456,
"name": "SAST Running",
"control_type": "scanner_sast_running"
},
"previous_status": "pass",
"current_status": "fail",
"changed_at": "2026-02-05T12:00:00Z"
}
This would enable:
- Real-time Slack/Teams notifications when compliance degrades
- Integration with incident management systems (PagerDuty, Opsgenie)
- Audit trail of compliance status changes over time
- Automated remediation workflows
Intended users
Feature Usage Metrics
- Count of webhooks configured with
compliance_control_status_changedevent enabled - Count of webhook deliveries for this event type
- Delivery success/failure rate
Does this feature require an audit event?
No - this IS the alerting mechanism. The webhook event itself provides the audit trail.
Related
- #580189 - Compliance controls should auto-update on scan completion
- #588370 (closed) - Track violations for failed status checks
- &13658 (closed) - External Controls epic