What does an alert payload look like and how is it signed?

Webhook payloads are JSON with incident, site, severity, and evidence fields. Every request is signed with HMAC-SHA256 using your channel secret.

Quick answer

Generic webhooks receive a JSON POST containing incident metadata, the affected site, severity, and evidence. Every request carries an X-Lemwatch-Signature header — HMAC-SHA256 of the raw body using your channel secret.

Payload shape

How to verify signatures

  1. Read X-Lemwatch-Signature and X-Lemwatch-Timestamp
  2. Recompute HMAC_SHA256(secret, timestamp + "." + raw_body)
  3. Compare with a constant-time equality check
  4. Reject requests older than 5 minutes

Where to find it in Lemwatch

Settings → Integrations → Webhook — reveals the secret and shows sample payloads.

Related