Outbound webhooks

A Custom Webhook recipient or escalation level POSTs the alert to a URL you choose. It is the bridge to anything AlertKick does not talk to natively: a ticketing system, a home-grown runbook runner, a light on the office wall.

Add one

In an escalation policy, choose Custom Webhook as a recipient type in the notifications block, or as a level type in the escalation levels, and paste the URL. HTTPS is strongly recommended; the payload contains your alert text.

The request

POST <your URL>
Content-Type: application/json
User-Agent: AlertKick-Webhook/1.0

{
  "event": "alert.escalated",
  "message": "Alert Escalation: HTTP check failed for https://shop.example.com (Level 2)",
  "subdomain": "acme",
  "timestamp": 1757100000,
  "data": {
    "alert_uuid": "5f1c…",
    "alert_subject": "HTTP check failed for https://shop.example.com",
    "alert_description": "3 consecutive failures from eu-west and us-east",
    "severity": "critical",
    "alert_status": "triggered",
    "level": 1,
    "action_type": "webhook",
    "recipient": "https://hooks.example.com/alertkick",
    "webhook_url": "https://hooks.example.com/alertkick"
  }
}

event names what happened, message is the escalation text with the level number (counted from 1), subdomain is your workspace, and timestamp is Unix seconds. data carries the alert - alert_uuid, alert_subject, alert_description, severity, alert_status - plus the level that fired (level, counted from 0, and action_type) and the level’s own fields such as webhook_url. Use alert_uuid with the API to fetch the full alert, acknowledge it, or resolve it.

Delivery

The request times out after 30 seconds. Escalation-level webhooks are fired as the level is reached and are not retried, so the receiver should answer quickly (any 2xx) and do its work afterwards. Webhooks queued through the notification pipeline are retried with exponential backoff - starting at 10 seconds, up to 5 minutes apart, for up to 15 minutes - before being parked in a dead-letter queue for inspection.

Receiving it

• Respond 200 immediately; do the slow part (creating a ticket, paging a third-party system) asynchronously.
• Use the alert identifier for idempotency: a level can fire again on repeat, and a policy can have several webhook levels.
• Restrict the endpoint to the AlertKick-Webhook/1.0 user agent and, if your receiver supports it, a secret in the URL path. There is no signing header today.
• To close the loop, call the alerts acknowledge endpoint (POST /api/v1/alerts/acknowledge with the alert UUID; see the API reference) from the receiver when your system has taken ownership; the escalation stops climbing. Authenticate with an API key.

Inbound is different

This page is AlertKick calling you. For your monitoring calling AlertKick - Prometheus, Grafana, Datadog, a generic webhook in - see Inbound alert sources.