API & Integrations

    What does an alert payload look like and how is it signed?

    Webhook payloads are JSON with incident, site, severity, and evidence fields. Every request is signed with HMAC-SHA256 using your channel secret.

    Updated 2026-07-10
    1 min read
    integrations
    webhook
    security

    Quick answer#

    Generic webhooks receive a JSON POST containing incident metadata, the affected site, severity, and evidence. Every request carries an X-Lemwatch-Signature header — HMAC-SHA256 of the raw body using your channel secret.

    Payload shape#

    {
  "event": "incident.opened",
  "incident_id": "inc_...",
  "site": { "id": "...", "url": "https://example.com" },
  "severity": "critical",
  "started_at": "2026-07-10T12:00:00Z",
  "evidence": { "status": 503, "response_ms": 15230 }
}

    How to verify signatures#

  1. Read X-Lemwatch-Signature and X-Lemwatch-Timestamp
  2. Recompute HMAC_SHA256(secret, timestamp + "." + raw_body)
  3. Compare with a constant-time equality check
  4. Reject requests older than 5 minutes

    5. Where to find it in Lemwatch#

    Settings → Integrations → Webhook — reveals the secret and shows sample payloads.

    Related#

  5. Webhook integration
  6. Test integrations
  7. Retries and failures
    8. Was this article helpful?

    Previous

    How do I test an integration is working?

    Next

    What happens when an integration fails to deliver?

    Related Articles

    Custom Webhook Integration

    Send alert data to any HTTP endpoint via custom webhooks. Slack and Discord URLs are auto-routed when used in escalation steps.

    How do I test an integration is working?

    Every integration has a Send Test button that fires a synthetic incident payload to the channel and confirms delivery in the UI.

    What happens when an integration fails to deliver?

    Lemwatch retries failed webhook deliveries up to 5 times with exponential backoff, then marks the channel as degraded and emails the org owner.

    What integrations does Lemwatch support?

    Lemwatch routes alerts to Slack, Discord, Teams, PagerDuty, Telegram, Google Chat, Mattermost, Rocket.Chat, ntfy, generic webhooks, and email.

    Back to Help Center