Webhooks - Event-Driven Alerts
Real-time monitoring for zero downtime
Route Status Events to Your Stack
StatusPulse delivers instant HTTP POST requests to your designated endpoints whenever a monitored endpoint triggers a state change, latency threshold breach, or scheduled maintenance window.
Integrate seamlessly with Slack, PagerDuty, Datadog, or custom internal dashboards. Each webhook includes a unique event identifier, timestamp, and payload matching the exact metric that triggered the alert. Set up delivery to https://api.yourcompany.com/statuspulse/hooks and verify connectivity with our test payload endpoint.
Payload Structure
All webhook deliveries use JSON encoding with a consistent schema designed for predictable parsing and automated routing.
Event Envelope
Contains event_id (UUID v4), timestamp (ISO 8601), version (currently 2.1), and source (always statuspulse-monitoring).
Trigger Context
Includes check_id, endpoint_url, previous_state, current_state, response_time_ms, and error_code when applicable.
Metadata
Carries team_slug, region (e.g., us-east-1), alert_priority (critical, warning, info), and retry_count for tracking delivery attempts.
Retry Logic & Delivery Guarantees
Network blips happen. StatusPulse ensures your critical alerts arrive using an exponential backoff strategy with configurable limits.
When your endpoint returns a non-2xx response or times out after 5 seconds, we automatically queue the payload for redelivery. Initial retry occurs at 15 seconds, followed by 30 seconds, 60 seconds, 5 minutes, 15 minutes, and a final attempt at 1 hour. If all attempts fail, the event is archived in your dashboard under Failed Deliveries for manual inspection. You can override the default 6-attempt cap per webhook configuration.
Security Signatures
Protect your endpoints from spoofed requests by validating the cryptographic signature attached to every webhook delivery.
StatusPulse signs each payload using HMAC-SHA256 with your unique webhook secret key. The signature is transmitted in the X-StatusPulse-Signature header alongside a X-StatusPulse-Timestamp to prevent replay attacks. Verify the signature server-side by reconstructing the hash of the raw request body and comparing it against the received header value. Reject any requests older than 5 minutes or missing a valid signature to maintain strict ingress controls.