Webhooks
Receive monitor events and inspect delivery behavior.
Use webhooks when your application should receive monitor events without polling. Configure one HTTPS target, keep the signing secret private, and inspect delivery records when debugging.
Configure a target
{
"url": "https://example.com/omnist/webhooks",
"enabled": true
}Targets must use HTTPS and cannot point to localhost, private IP ranges, reserved IP ranges, or URLs with embedded credentials.
Verify signatures
Webhook requests include a signature header:
X-Omnist-Signature: t=1760000000,v1=<hex-hmac>
X-Omnist-Event-Id: evt_...
X-Omnist-Delivery-Id: del_...Compute the HMAC over the timestamp and raw request body using the active signing secret. Reject stale timestamps and mismatched signatures before processing the event.
Delivery behavior
Omnist retries failed deliveries up to five attempts. The current retry delays are approximately:
| Attempt | Delay after prior failure |
|---|---|
| 2 | 5 minutes |
| 3 | 60 minutes |
| 4 | 3 hours |
| 5 | 24 hours |
Use GET /v1/webhooks/events, GET /v1/webhooks/stats, and GET /v1/webhooks/test to inspect recent behavior.