Skip to main content

Webhook

How it works​

When an incident event fires, isthisthing.online sends a POST request with a JSON body to the URL you configure. If you provide a signing secret, every request includes an HMAC-SHA256 signature header so you can verify authenticity.

1. Prepare your endpoint​

Your server needs an HTTP endpoint that:

  • Accepts POST with Content-Type: application/json.
  • Returns 2xx within 10 seconds (otherwise the delivery is retried).

2. Add the integration​

  1. Navigate to Integrations → New Integration.
  2. Select Webhook.
  3. Fill in the fields:
FieldValue
Namee.g. Production Webhook
Webhook URLYour endpoint, e.g. https://api.example.com/hooks/incidents
Signing SecretOptional. If set, every request carries X-isthisthing.online-Signature.
  1. Enable trigger events and click Save.

If you set a signing secret, validate every incoming request:

const crypto = require('crypto');

function verify(body, secret, headerValue) {
  const expected = 'sha256=' +
    crypto.createHmac('sha256', secret).update(body).digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(headerValue)
  );
}

Payload schema​

{
  "incidentId": "clx...",
  "eventType": "incident.created",
  "title": "API latency spike",
  "description": "p99 latency above 2 s for 5 minutes",
  "status": "OPEN",
  "source": "MONITOR",
  "monitorId": "clx...",
  "monitorName": "Production API",
  "monitorUrl": "https://api.example.com/health",
  "startedAt": "2026-04-08T12:00:00.000Z",
  "resolvedAt": null,
  "emittedAt": "2026-04-08T12:00:01.234Z",
  "workspaceId": "clx...",
  "workspaceName": "Acme Corp",
  "workspaceSlug": "acme",
  "incidentUrl": "https://app.isthisthing.online/en/acme/incidents/clx...",
  "workspaceUrl": "https://app.isthisthing.online/en/acme/dashboard"
}

Retry policy​

AttemptDelay
1st retry30 seconds
2nd retry2 minutes
3rd retry10 minutes

After 3 failed attempts the event moves to dead letter and is no longer retried.

Security​

  • Always verify the X-isthisthing.online-Signature header.
  • Use HTTPS endpoints only.
  • Rotate the signing secret if it is compromised.

See also​