A webhook or service endpoint using plaintext HTTP
What it is
Integration endpoint sends payloads over plaintext HTTP.
Why it matters
A service endpoint or webhook uses http, so record data, execution context, and any credential in the message cross the network unencrypted.
Find it yourself
List your service endpoints and webhooks and read the URL scheme on each. Anything starting http rather than https is the finding, and any credential that has been traveling over it should be treated as exposed.
How to fix it
Re-register against https, verify the certificate, and rotate any credential sent in the clear.
Related controls
These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.
CMMC relevance
This condition produces evidence for SC.L2-3.13.8 (Level 2: use cryptographic mechanisms to prevent disclosure of CUI in transmission), for the Dataverse system in your assessment scope. Plaintext HTTP is the case 3.13.8 exists to name. Whatever the webhook carries crosses the network unprotected, and what it carries is decided by the message it fires on rather than by anyone reviewing it.
Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.
Pathix checks this across every environment you scan, along with 71 other conditions. Self-hosted in your own Azure, read-only, metadata-only.