Integrations
API and webhooks for custom integrations
When a native integration does not exist for a tool you rely on, here is what Radius360 offers today and how to ask for more.
When to use the API
The 46 native integrations cover the most common security and productivity tools. Common reasons teams ask for programmatic access:
- Internal tools your team built that produce security-relevant data
- Specialized vendors not yet in our native catalog
- Data lakes or warehouses where your consolidated security signals already live
- Custom GRC workflows that push evidence on a cadence your team controls
Radius360 does not offer a self-serve public REST API today. If you need one of the above, or a commonly-requested source is not natively supported, email support@radius360.co. Native integration builds are prioritized by customer demand.
Authentication
There are no customer-issued API keys in the app today. Outbound webhooks (below) need no key: you give Radius360 a URL and it posts to it.
Treat webhook URLs as secrets
Anyone who has a Slack or Teams incoming-webhook URL can post to that channel. Keep the URL out of shared documents and rotate it in Slack or Teams if it leaks.Core resources
Risks, policies, evidence, frameworks, incidents, and posture are available in the app and in exports and reports. They are not exposed through a public API today.
Pushing evidence via API
Evidence that does not come from a native integration can be added from the app: upload it in the Evidence Vault, or drop documents into Document Intake so they are classified and attached to the right controls. There is no evidence-push endpoint today.
Webhooks out of Radius360
Radius360 can post alerts to Slack, Microsoft Teams, or any webhook URL. Add a webhook from the Notifications tab in Settings, give it a name, and choose which events it receives:
- Critical risks
- Policy approvals
- Compliance changes
- Incidents
- Evidence expiry
Each event is sent as a JSON POST in Slack-compatible format (a text field plus message blocks, with a link back to Radius360). Click Send Test Notification to send a sample message and confirm the webhook works.
Delivery failures
Radius360 sends each event once. If your receiver returns an error, the webhook shows an Error badge and the last error message on the Notifications tab; the event is not retried. Payloads are not signed, so if your receiver is a custom endpoint, use a hard-to-guess URL.Webhooks into Radius360
Radius360 does not accept inbound webhooks today. Native integrations pull data from your tools on a schedule instead; see sync cadence.
Rate limits
With no public API there are no API rate limits to plan around. Outbound webhooks are sent as events happen.
Related reading: Sync cadence and rate limits (native integrations), Billing and plan features.