Sending alerts to a webhook

Besides email and Slack, an alert can call an address in your own system. That is how you open a ticket automatically, store the event in your database or trigger a flow in Zapier, Make or n8n — none of those require a dedicated integration: they all accept an incoming webhook.

How to set it up

1. Go to Alerts and create a new alert (or edit an existing one).

2. Fill in the name, condition and survey, just like any other alert.

3. Under Notification Methods, check Webhook.

4. Enter the endpoint URL that will receive the call and save.

5. After saving, a signing secret appears in the form. Copy and keep it — that is how your system confirms the call came from us.

URL requirements

• It must use HTTPS. Over HTTP the payload and the signature would travel in the clear.

• It must be reachable from the internet. Internal addresses (localhost, 192.168.x.x, 10.x.x.x) are rejected for security reasons.

• It must not answer with a redirect — delivery goes to the address you provided, and only to it.

What we send

A POST with Content-Type: application/json and a body in this format:

{
  "event": "alert.triggered",
  "alert": {
    "id": "12",
    "name": "Critical NPS",
    "condition": "nps_below",
    "threshold": 30
  },
  "survey": {
    "id": "01jabc...",
    "title": "Post-support"
  },
  "context": {
    "current_nps": "12",
    "threshold": "30",
    "window": "last 30 days",
    "responses": "48"
  },
  "triggered_at": "2026-07-27T12:34:56-03:00"
}

Two details that matter when you write the integration:

• condition is a stable code, not translated text. The possible values are nps_below, nps_above, sentiment_negative, no_response, response_rate_below and new_feedback. You can switch on them without worrying that the dashboard language changes the behaviour.

• survey comes as null when the alert applies to all surveys.

Verifying the signature

Every call carries a Signature header, the HMAC-SHA256 of the body using your signing secret. Check it before acting on the content — without that, anyone who discovers your URL can forge an alert. In PHP:

$expected = hash_hmac('sha256', $rawBody, $yourSecret);

if (! hash_equals($expected, $request->header('Signature'))) {
    abort(403);
}

Retries

If your endpoint does not answer successfully, we retry up to 3 times, waiting longer between each attempt. Each call has a 5 second limit — answer fast (an immediate 200) and process afterwards, in the background.

If all three attempts fail, the alert card starts showing last delivery failed with the reason. It is worth checking that mark now and then: it is how you find out the integration stopped.

About privacy

The payload does not identify who responded. When the survey is anonymous, that is a promise made to the respondent — and it holds here too: the comment and the score go through, the name and the email do not.

Changing the URL or removing it

Changing the address keeps the same signing secret, so you do not need to reconfigure verification on your side. Unchecking the Webhook method removes the URL and deletes the secret — if you enable it again later, a new secret is generated.