A WebCheck webhook sends JSON about monitoring events to an HTTPS endpoint that you control. WebCheck validates the destination, limits the request and can add an HMAC signature so your receiver can verify the body was created with the configured secret.
Configure a webhook
- Open the monitored site and select Configure in Notifications.
- Choose Generic webhook, enter a label and provide the public endpoint URL.
- Optionally enter a signing secret and save the destination.
- Keep the endpoint public, controlled by you and ready to accept JSON POST requests.
What WebCheck sends
Incident webhooks include the event, incident ID, site, target, check type, state, severity, failure count, diagnosis, recommended action, incident URL and timing fields. Monitoring-event webhooks include the event ID and the event payload.
Verify the signature
When a secret is configured, WebCheck sends `X-WebCheck-Signature: sha256=<hex>` where the hex value is an HMAC-SHA256 digest of the exact JSON request body. Read the raw body, calculate the digest with your secret and compare it using a constant-time comparison.
Delivery behaviour
Webhook delivery has a 10-second HTTP timeout, creates a delivery record and avoids sending the same recorded delivery again after success. Failed deliveries retain a bounded error and can be retried by the queue job.
Security limitations
WebCheck rejects private or unsafe webhook destinations through its URL-safety validation. Treat the signing secret as sensitive and do not place it in an article, label, URL or public client-side code.