Webhook Notifications

A webhook channel delivers alerts to an HTTPS endpoint you control. Each time an alert triggers (and, if you enable it, when it resolves), Fleetera sends an HTTP POST with a signed JSON body to the channel's URL.

You create one webhook channel per destination and then attach it to the alerts you want it to deliver. A single channel can serve many alerts.

What a webhook channel needs

Custom header limits

If you supply custom headers, they are bounded to keep requests well-formed:

• At most 20 headers.
• Each header name is at most 128 characters.
• Each header value is at most 4096 characters.

Fleetera sets its own headers on every request (Content-Type, the signature headers, the delivery and event headers — see Verifying Webhook Signatures). If a custom header you provide collides with one of these reserved names, the reserved value takes precedence and your value is dropped.

Creating a webhook channel

Webhook channels are managed in Settings → Notification channels. Create a channel, choose the Webhook type, enter the destination URL, and add any custom headers your receiver requires.

Channels can also be managed through the platform API. The request below creates a webhook channel:

POST /notification-channels
Content-Type: application/json

{
  "name": "Ops Slack relay",
  "type": "webhook",
  "config": {
    "url": "https://hooks.example.com/fleetera-alerts",
    "headers": {
      "Authorization": "Bearer your-receiver-token"
    },
    "includeResolved": true
  }
}

The response describes the created channel and — for webhook channels — includes the signing secret exactly once, in the secretShownOnce field:

{
  "id": "0b8f2c1e-9d3a-4f57-bb20-2c6f0a1e4d9a",
  "name": "Ops Slack relay",
  "type": "webhook",
  "config": {
    "url": "https://hooks.example.com/fleetera-alerts",
    "headers": { "Authorization": "Bearer your-receiver-token" },
    "includeResolved": true
  },
  "enabled": true,
  "hasSecret": true,
  "secretShownOnce": "whsec_3f9a7c2b8e1d4a6f0c5b9e2d7a4f1c8b",
  "createdAt": "2026-06-10T09:30:00.000Z",
  "updatedAt": "2026-06-10T09:30:00.000Z"
}

The signing secret

The signing secret is generated by Fleetera, not chosen by you, and is unique to each channel. Its only purpose is to let your receiver authenticate incoming requests: Fleetera signs every request body with it, and your endpoint recomputes the signature to confirm the request is genuine. See Verifying Webhook Signatures for the recipe.

Because the secret is part of the channel's identity, treat it as sensitive:

• Store it in a secrets manager or your receiver's environment configuration — never in source control or a shared document.
• Use a distinct receiver per channel where possible, so a single channel's secret only protects one endpoint.

Rotating the secret

This release does not support rotating a channel's secret in place. To roll a secret:

1. Create a new webhook channel pointing at the same URL and copy its secretShownOnce.
2. Update your receiver to accept signatures from either secret during a short overlap window.
3. Move your alerts over to the new channel.
4. Once no traffic is arriving on the old channel, delete it and remove the old secret from your receiver.

Updating and removing a channel

You can rename a channel, change its URL or headers, and enable or disable it after creation. A channel's type cannot be changed — to switch a destination to a different channel type, create a new channel. Updating a webhook channel never returns the signing secret again; the existing secret continues to apply.

Verifying a channel works

Before you rely on a channel, send a test notification to confirm your endpoint receives and accepts a signed request. The test-send walkthrough covers this end to end, including how to read the delivery result.