Google SecOps SOAR webhook rejects Canarytokens URL validation

Hi all,

I am wondering whether this is a Canary issue or a Secops one but I am trying to send alerts from a free Canarytokens into a Google SecOps SOAR webhook.

What I have configured:

In SecOps SOAR, I created and enabled a webhook. The mandatory alert fields are mapped from a Canarytokens payload as follows:

• TicketId → token
• SourceSystemName → static value: Canarytokens
• Name → token_type
• DeviceVendor → static value: Thinkst
• RuleGenerator → static value: Canarytokens
• StartTime → time

This is what the payload looks like: 

{
  "channel": "DNS",
  "token_type": "adobe_pdf",
  "src_ip": "0.0.0.0",
  "token": "example-canary-token-id",
  "time": "2026-09-09 15:27:23 (UTC)",
  "memo": "Test",
  "additional_data": {
    "geo_info": {
      "country": "US",
      "city": "Example City",
      "org": "Example ISP"
    },
    "time_hm": "15:27",
    "time_ymd": "2026/09/09"
  },
  "public_domain": "canarytokens.org"
}

The Testing feature in the SecOps webhook returns:

{

  "status": 200,

  "statusText": "OK"

}

Problem

When I paste the SecOps webhook URL into Canarytokens during token creation, Canarytokens returns:

Invalid webhook supplied. Confirm you can POST to this URL.

I can successfully use the same Canarytokens token with a temporary ngrok endpoint that returns 200 OK, and ngrok captures the JSON shown above. This suggests Canarytokens can reach the endpoint and sends a valid POST body.

Question

Does anyone know why the SecOps webhook test succeeds with HTTP 200, but Canarytokens rejects the same webhook URL during its validation step?

Thanks in advance!