Give your own tools a signed heads-up

A little bridge for every nest

Workspace owners on every plan can open Account → Integrations → Signed webhook. Add one public HTTPS receiver for the workspace. All active monitors share this connection. Your receiver gets a test, monitor_down or monitor_up event; monitor target URLs and request credentials are not included. This connects your own software, rather than creating tickets in a particular helpdesk.

Connect and save your key

Save the connection, then copy the signing secret immediately into your receiver’s secret storage. It is shown only once. The receiver must verify each signature before using the message. Send a test once the receiver is ready, then check Recent deliveries. A successful response confirms that your receiver accepted the request, not that its later work finished.

Verify each arrival

UptimeOwl sends JSON with schemaVersion, id, event, workspaceId, occurredAt, monitor and text. Monitor contains id, name, status and statusCode; it is null for tests. occurredAt records when UptimeOwl queued the event. The headers UptimeOwl-Event-Id, UptimeOwl-Timestamp and UptimeOwl-Signature authenticate the event.

For signature version v1, compute HMAC-SHA256 using the signing secret as its literal text, over TIMESTAMP.EVENT_ID.RAW_BODY. Compare the hex signature using a constant-time comparison. Use the exact bytes received, not parsed and reserialized JSON. Reject timestamps more than five minutes away from your clock, reject mismatched header/body IDs, and durably deduplicate the event ID before applying side effects. Retries keep the event and payload but receive a fresh signing timestamp. Events can arrive out of order: do not blindly overwrite newer state with an older alert.

Keep delivery calm

Respond with a 2xx status promptly after safely accepting the event. Each attempt has a five-second deadline including DNS and connection. UptimeOwl retries connection failures, 429 and 5xx responses up to five total attempts within 24 hours. Other responses, including redirects, fail. Retry delays normally begin at 30 seconds and increase; Retry-After in seconds can extend that delay. Delivery is best effort with possible duplicates, so receiver deduplication is essential.

Private, loopback, link-local and mixed public/private DNS destinations are rejected. DNS is checked again for every attempt. Keep TLS certificates valid. Recent deliveries in Integrations show the latest ten integration entries. Notifications has its own history for Slack, Teams, email and mobile push. Check the receiver if an entry needs attention; after fixing it, send a new test.

Rest, rotate or disconnect

Turn the switch off to pause webhooks without deleting the connection. Resuming starts with new events; it does not release an old backlog. Paused monitors, maintenance windows and suspended workspaces stay quiet.

To rotate a key, enter the receiver URL again and save. Confirm the replacement, copy the fresh signing secret and update your receiver. Rotation takes effect immediately and retires queued events from the previous connection; there is no old-key overlap. Disconnect asks for confirmation and stops future deliveries. Configuration changes appear in Workspace history without secrets.