Updated 2026-09-29
Webhook channels are built so you can point Status at your own tooling — Slack, PagerDuty, an internal ingestion endpoint — without writing a translation shim.
Payload presets
When you create a webhook, you pick a starting payload preset: generic, Slack, Discord, PagerDuty, Opsgenie, Teams, or fully custom. Presets are just a starting template — pick one and edit it freely afterward.
The template syntax
Payloads use a small, deliberately limited template syntax — no code execution, no loops or conditionals:
{{path.to.var}}inserts a value as an escaped string (you supply the surrounding quotes) — for example"name": "{{check.name}}".{{{path.to.var}}}inserts a raw JSON value (numbers, booleans, arrays) — for example"duration_seconds": {{{incident.durationSeconds}}}.
Available variables cover the check (check.name, check.type,
check.target, check.tags), the incident (incident.cause,
incident.startedAt, incident.confirmations, incident.regions), the
triggering result (result.statusCode, result.responseMs, result.error),
and deep links back into your dashboard (urls.incident, urls.check,
urls.statusPage). The full catalog is shown as clickable chips in the
webhook editor.
Validation
When you save a webhook (or use the preview endpoint), your template is rendered against a sample event and checked: if the channel's content type is JSON, the rendered output must parse as valid JSON, or you'll see an error with the line and column to fix. The same re-validation happens again at actual delivery time as a safety net — if a real event were ever to somehow produce invalid JSON, nothing is sent and the attempt is logged as failed rather than delivering garbage to your systems.
Signing
Each delivery carries X-Status-Signature: t=<unix-timestamp>,v1=<hex>, where
v1 is HMAC-SHA256 of <timestamp>.<raw body> using your account's webhook
secret. To verify, recompute it and compare, and reject old timestamps to stop
replays. Deliveries also carry X-Status-Event (the event kind) and
X-Status-Delivery (a unique id you can use to ignore duplicates). Signing is
on by default per channel; the secret can be rotated by an Owner or Admin from
the Security page (Settings → Security).
Custom headers
You can add custom headers (for example an Authorization header for your
receiver) up to your plan's limit. Header values are encrypted at rest.
Certain headers (Host, Content-Length, Transfer-Encoding, Connection)
can't be overridden, and header injection attempts are rejected outright.
Delivery and destination safety
Webhooks are sent as POST (or PUT) and follow up to 3 redirects, each re-checked.
Every webhook destination is checked at save time — and again at every delivery, since DNS can change — to reject private, loopback, and metadata network ranges, so a webhook can't be pointed at internal infrastructure. Failed deliveries retry with backoff before the channel is disabled (see Email and webhook alert channels).
Alert thresholds
Confirmations, alert delay, re-alerts, escalation and the other per-check alert options aren't specific to webhooks. See Alert policies.