Outbound webhooks

Creating one

1. Click New webhook and give it a name, for example Zapier.
2. Paste the destination URL. It has to be a public endpoint: private and internal addresses are rejected, and every redirect is re-checked.
3. Tick the alert types it should receive and set a minimum severity, the same choices an alerts subscription offers.
4. Copy the signing secret shown once on creation and configure it in your receiver. It is never displayed again.
5. Use the send icon for a single test event, or the icon beside it to POST four example events covering different event types, so you can build and test your handler before a detector ever fires. Examples carry payload.sample: true and a sample- prefixed id.

What arrives

One POST per event, with Content-Type: application/json:

{
  "id": "<event uuid>",
  "event_type": "traffic_anomaly",
  "severity": "high",
  "site_id": "<property uuid, or null>",
  "occurred_at": "2026-08-29T06:00:00.000Z",
  "payload": { "siteUrl": "https://example.com/", "metric": "clicks", "...": "..." },
  "source": "gscwizard"
}

The payload object differs per event type and carries the specifics: the property, the metric, the dates, the affected URLs.

Verifying the signature

Every request carries X-GSCWizard-Signature: sha256=<hex>, an HMAC-SHA256 of the raw request body using that webhook’s secret. Compute the same HMAC over the raw bytes you received, before any JSON parsing, and compare the two in constant time. Requests also identify themselves with a GSCWizard-Webhook/1.0 user agent, but the signature is the thing to trust.

Delivery behaviour

• Deliveries run on the same job as Slack, which ticks every ten minutes, so a webhook fires within minutes of detection.
• Each request times out after ten seconds. Failures that look temporary are retried on a later run; a webhook that keeps failing is disabled, with the reason shown on its row.
• Respond 2xx as soon as you have the event and do the work asynchronously.
• Webhooks can be paused, edited, and deleted at any time. The secret cannot be revealed again: to rotate it, create a new webhook and delete the old one.