---
title: Uptime Monitoring Webhooks with HMAC Signing
description: POST incident JSON to your own endpoint, signed with HMAC-SHA256 so you can verify it came from us. Full field reference and delivery rules.
canonical: https://watchfor.io/integrations/webhooks
---

[← All alert channels](/integrations)

# Webhooks you can verify came from us

A webhook you cannot verify is an endpoint anyone can forge an incident into. Every payload we send is signed with HMAC-SHA256 so your receiver can check it before acting, and the exact JSON — every field, every enum — is published in the docs rather than left to be reverse-engineered from a sample.

[Start free](/auth/signup)[Setup guide](/docs/notifications/webhooks)

## Setting it up

Signed HTTPS POST to an endpoint you control .

- 1 Expose an HTTPS endpoint that accepts a POST and returns quickly.
- 2 Add it in Alerting → Channels & contacts → Add Channel → Webhook and store the signing secret.
- 3 Verify the HMAC-SHA256 signature on each request, then send a test to confirm the round trip.

The full procedure, including every optional field, is in the [setup guide](/docs/notifications/webhooks).

## What the alert looks like in Webhooks

A JSON body with the incident id, monitor, target, severity, state, diagnosis, expected and detected values, confirming locations and timestamps — plus a signature header your receiver checks before trusting any of it.

## Specific to Webhooks

- HMAC-SHA256 signature on every delivery.
- The full payload schema is documented, not left to guesswork.
- A flattened variant is available for Zapier, where nested JSON is awkward.

## True of every channel

- Alerts fire on confirmed incidents, not on a single failed check, so one blip from one probe does not wake anyone.
- During a storm, several incidents inside the grouping window arrive as one summary rather than as twenty separate messages.
- Recovery closes the same thread it opened, with the outage duration attached.
- Every channel is on every plan, including the free one. There is no per-channel upsell.

## Questions people ask

How do I know a request really came from WatchFor? Each POST carries an HMAC-SHA256 signature computed over the body with the secret shown when you created the channel. Recompute it on your side and compare before acting on the payload.

What does the payload contain? The incident id, the monitor and target, severity and state, the diagnosis, expected versus detected values, which locations confirmed it, and timestamps. The complete field list is in the docs.

Can I use this with Zapier? Yes. Zapier handles nested JSON poorly, so there is a flattened payload variant for it — see the Zapier section of the webhooks docs.

## Wire it up in a few minutes

15 monitors free, every alert channel included, no card required.

[Start free](/auth/signup)[See all channels](/integrations)

---

Canonical page: https://watchfor.io/integrations/webhooks · Site guide: https://watchfor.io/llms.txt