Get early access
Features · For Developers · Webhooks
For Developers · Webhooks

Every event,
where you need it.

Alerts, incidents, deploys, agent state changes, backup runs — pushed as signed JSON to the endpoint you control. HMAC-signed, retried with jitter, dead-lettered after the policy you set.

POST /hooks/hostatlas
X-HostAtlas-Signature: sha256=9f2c…
{ "event": "incident.opened",
"severity": "page",
"host": "db-prod-01" }
retried with jitter until 2xx
— Why this matters

Your systems should hear about this without polling us.

01

Signed, or it is not trustworthy.

Every payload carries an HMAC signature. A receiver that does not verify it is accepting anything that knows the URL.

02

Retries with jitter, not a thundering herd.

A failed delivery is retried with backoff. If your endpoint comes back after an outage, it is not hit by everything at once.

03

One surface, not one per feature.

The same API that serves the backup CLI, the desktop apps and the MCP bridges — so an integration written once keeps working.

— What's included

What you get and how it is secured.

Events
Alerts, incidents, deploys, agent state changes and backup runs.
HMAC-SHA256
Per-tenant secret, signature in the header.
Retry with backoff
Until a 2xx, with jitter.
Dual auth on the API
Long-lived ha_* keys, hashed and compared timing-safely, or OIDC-issued tokens.
Permission-scoped
Every route carries read or write permission plus the per-tool policy check.
Tenant-scoped by construction
Scoping is applied globally rather than per query, so cross-tenant access is not something a missed where can cause.
Documented end to end
Request and response shapes, on the docs site.
— How it works

Signed, retried, then parked.

1

An event happens

Alerts, incidents, deploys, agent state changes and backup runs all emit on the same surface.

2

Signed before it leaves

HMAC-SHA256 over the payload, so your endpoint can tell our delivery from anyone else's.

3

Retry, then dead-letter

Backoff with jitter for up to 24 hours, then the delivery is parked where you can replay it after you fix the handler.

— Works with

Connected capabilities

Notification Channels
Webhook is one of several outbound channels.
→
Automations
Webhook as an automation target — same engine.
→
REST API
The pull side of the API surface.
→
SIEM Forwarding
Bulk-event variant, formatted for SIEMs.
→
— FAQ

Questions, answered honestly.

What if my endpoint is down? +
Retries with backoff, up to 24 h. After that, the event lands in the DLQ with a per-endpoint counter. An alert fires when the DLQ grows.
Per-event vs. batched delivery? +
Per-event by default. Batched mode (up to 100 events per POST) on Enterprise for high-volume sinks.
How do I rotate the signing secret? +
Generate a new one; both old + new are accepted for a grace window (configurable, default 24 h). Then revoke the old.

Push the event, retry the network.

Webhooks from Starter; high-volume + batched from Enterprise.

Get early access Back to For Developers