Outbound Webhooks

Outbound webhooks deliver JSON event payloads to HTTPS endpoints you control. Register endpoints from Outbound webhook endpoints, or let visitors subscribe from a status dashboard when the channel is enabled.

For JSON payload format, visibility rules, and delivery logs, see Webhook notifications. For the public /subscribe flow, see Webhook subscriptions.

Signing

Outbound webhooks always include:

The HMAC is computed over the string <timestamp>.<raw_request_body> (UTF-8) with the per-endpoint signing secret, using the same algorithm as inbound webhooks.

How to get the signing secret

The secret is never returned from list APIs, manage GET, or email. After a rotate, the previous secret stops verifying immediately.

Verify a delivery

const crypto = require('crypto');

function verifyStatusDashboardSignature(rawBody, signatureHeader, secret) {
  const match = /^t=(\d+),v1=([0-9a-f]+)$/.exec(signatureHeader || '');
  if (!match) return false;
  const ts = parseInt(match[1], 10);
  const received = match[2];
  if (Math.abs(Math.floor(Date.now() / 1000) - ts) > 300) return false; // 5 minutes
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${ts}.${rawBody}`)
    .digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));
}

Use the raw request body (before JSON parse) for the HMAC.

Endpoint URL rules

Webhook endpoints must be absolute HTTPS URLs on port 443, with no embedded credentials. Any public host that passes destination validation is accepted. StatusDashboard rejects private, loopback, and link-local destinations.

Endpoint URLs may contain secrets. StatusDashboard stores and displays a redacted url display form (host plus a short path hint). The full URL is returned only once on admin create responses. List and update responses use urlDisplay and identify rows by a stable endpoint hash (urlHash).

Managing subscribers

Organization admins and users with the subscriber role can register a pre-verified endpoint on Outbound webhook endpoints. No verification email is sent for admin-created rows.

Use the pencil icon on a row to change components, pause or resume deliveries, or toggle the locked flag. The list icon shows the current component selection read-only.

Suppression

After 5 consecutive failed event-notification deliveries, StatusDashboard automatically suppresses the endpoint:

• Future deliveries are skipped until suppression is cleared.
• The subscriber row shows a suppressed status.
• The management email receives one alert email (not one email per failed delivery).

StatusDashboard does not email the management address for individual failures before suppression. Use Webhook delivery logs to review per-attempt outcomes.

Review or clear suppressed endpoints on Outbound webhook suppression.

Failure alert email

When suppression triggers, the management email receives a message that webhook notifications were disabled for that endpoint. The email includes:

• The status dashboard name and a redacted endpoint display (never the full URL)
• The consecutive failure count that triggered suppression
• The last failure reason when available (for example, HTTP 503)
• A Manage subscription link when a signed manage URL is available; otherwise instructions to request a new manage link from the status page

Clear suppression entries on Outbound webhook suppression, or unsuspend from the public manage page, after fixing the destination. Clearing suppression does not resend missed notifications.