---
title: "What does an alert payload look like and how is it signed?…"
description: "Webhook payloads are JSON with incident, site, severity, and evidence fields. Every request is signed with HMAC-SHA256 using your channel secret."
canonical: "https://lemwatch.com/help/integration-payloads-and-signatures"
source: "https://lemwatch.com"
---

# What does an alert payload look like and how is it signed?

> Webhook payloads are JSON with incident, site, severity, and evidence fields. Every request is signed with HMAC-SHA256 using your channel secret.

## Quick answer

 Generic webhooks receive a JSON POST containing incident metadata, the affected site, severity, and evidence. Every request carries an X-Lemwatch-Signature header — HMAC-SHA256 of the raw body using your channel secret.

## Payload shape

## How to verify signatures

- Read X-Lemwatch-Signature and X-Lemwatch-Timestamp

- Recompute HMAC_SHA256(secret, timestamp + "." + raw_body)

- Compare with a constant-time equality check

- Reject requests older than 5 minutes

## Where to find it in Lemwatch

 **Settings → Integrations → Webhook** — reveals the secret and shows sample payloads.

## Related

- Webhook integration

- Test integrations

- Retries and failures


## Related

- [Help centre](https://lemwatch.com/help)
- [Custom Webhook Integration](https://lemwatch.com/help/webhook-integration)
- [How do I test an integration is working?](https://lemwatch.com/help/integration-testing-and-verify)
- [What happens when an integration fails to deliver?](https://lemwatch.com/help/integration-retries-and-failures)
- [How does Lemwatch monitor XML sitemaps?](https://lemwatch.com/help/sitemap-monitoring)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [Using the Insights Page](https://lemwatch.com/help/insights-page)