Webhook.

Setup.

1. 1

   Open Settings → Webhooks

   Click **Add webhook** and paste the destination URL. Save the auto-generated **signing secret** somewhere safe — it's what your endpoint validates incoming requests against.

2. 2

   Pick events

   Subscribe to the specific events you want (`incident.created`, `incident.updated`, `incident.resolved`, `service.status_changed`, `dependency.risk_changed`, `alert.triggered`, `telemetry.anomaly`).

3. 3

   Verify the signature on every request

   Compute HMAC-SHA256 of the raw request body using your signing secret and compare against `X-Webhook-Signature` in constant time. Reject anything that doesn't match — even leaked URLs are useless without the secret.

Verify a webhook signature (Node.js).

import crypto from "node:crypto";

export function verifySignature(
  body: string,
  signature: string,
  secret: string,
): boolean {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(body).digest("hex");
  if (signature.length !== expected.length) return false;
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected),
  );
}