Skip to main content
Outbound webhooks deliver Observer alerts to an HTTPS endpoint as JSON. They are the integration path for paging tools, ticketing systems, and chat tools that Observer has no native integration for. Webhooks are created on the Alerts page as a destination with the Generic webhook channel, alongside the native channels (Slack, Discord, Microsoft Teams, Telegram, PagerDuty, Jira, Splunk On-Call, Grafana IRM, and email). Alert destinations require a Starter plan or higher, and the number of destinations is capped per plan.

​
Available event types

​
Incidents

​
Maintenance

​
Metrics

​
Agent health (org-wide destinations only)

​
Hosted checks (org-wide destinations only)

​
SLOs (org-wide destinations only)

​
SLA Ledger (org-wide destinations only)

​
Digest

alert.digest is sent once a day to destinations that use Daily digest instead of instant delivery. It summarizes the events that were batched for that destination.

​
Create a generic webhook

1

Add the destination

In the console, open Alerts, then Add destination, and choose Generic webhook under Channel. Under Connection, set:
  • Endpoint URL: an https:// URL on a publicly reachable host that accepts POST requests with a JSON body.
  • Signing secret (optional): a shared secret. When set, Observer signs every delivery with HMAC-SHA-256 (see Verify the signature).
Both values are stored encrypted. Send test sends one test message with these details without saving.
2

Choose alerts and routing

Under Alerts, pick a preset:
  • Paging (the default): incidents (published, updated, resolved) and metrics turning unhealthy.
  • Everything, daily digest: every alert, batched into one summary a day.
  • Custom: pick the alerts yourself. Custom also has the Daily digest instead of instant delivery switch.
Agent health, SLO, and SLA Ledger alerts are available only to org-wide destinations.Under Routing, set Status page to All status pages (organization-wide) or a single page. You can also narrow when the destination fires by Services, Metrics, and Minimum severity, and choose whether to Alert during scheduled maintenance. Recoveries and resolves always deliver, so alerts your receiver opened can close.Select Add destination to save.
3

Send a test

On the Alerts page, open the destination’s actions menu and choose Send test. Observer sends a test delivery and reports whether it succeeded.

​
Payload

By default each delivery is a JSON envelope:
event is one of the event types above. severity and status depend on the event and may be null. See the webhook payload reference for every field. Each request is a POST with Content-Type: application/json. Respond with a 2xx status within 10 seconds.

​
Verify the signature

When a signing secret is set, every delivery includes three headers:
The signed material for X-Observer-Signature is ${timestamp}.${rawBody}. To verify:
  1. Read X-Observer-Timestamp. Reject the delivery if it is more than five minutes from the current time on the receiver. This skew window bounds replay attacks against captured deliveries.
  2. Compute HMAC-SHA-256(secret, "${timestamp}.${rawBody}") and hex-encode the digest. Prepend sha256=.
  3. Compare against X-Observer-Signature using a constant-time comparison (crypto.timingSafeEqual in Node, hmac.compare_digest in Python, equivalents elsewhere). String equality leaks information through timing side channels.
Reject deliveries whose signatures do not match.
Legacy headerX-Observer-Signature-Legacy carries HMAC-SHA-256(secret, rawBody) for receivers that have not migrated to the timestamp-prefixed scheme. It is still sent for compatibility and will be removed in a future release. Use the timestamp-prefixed X-Observer-Signature for new receivers; receivers relying on X-Observer-Signature-Legacy lose replay protection.

​
Retries and delivery history

A delivery that times out, hits a network error, or receives a 429 or 5xx response is retried with exponential backoff, up to five attempts. Other 4xx responses are not retried. Latest alerts, at the top of the Alerts page above Destinations, shows each delivery’s status (Delivered, Failed, Retrying, or Skipped), destination, event, and time. Open a row to see the attempt number, HTTP status, error, and the stored payload. Failed deliveries with a stored payload have a Redeliver button that queues the same payload again.

​
Legacy webhook subscriptions

Webhook subscriptions created on the old Webhooks settings page still deliver for organisations that created them. That page now redirects to Alerts, and new webhooks can only be created as alert destinations. Legacy deliveries keep their original payload shape; see the legacy section of the webhook payload reference.