Create a webhook notifier

To configure a webhook notifier, enter a URL that specifies the endpoint to send HTTP POST requests to. You can use variables in your notifiers.

Web
Chronoctl
Terraform
API

To create a webhook notifier:

In the navigation menu select Alerts> Notifiers.
Click Create notifier.
Enter a descriptive name for the notifier.
Select Webhook as the type of notifier you want to create.
In the URL field, enter a URL, which is called as a POST request. For example:
```
https://webhook.site/3723e8cb-b1b4-4399-86b0-e37f36a2acc5
```
Optional: Select Notify when resolved to send a resolved alert notification.
Click Save.

To create one or more notifiers using Chronoctl, create a YAML file that defines them and apply the configuration to your instance.

You can use the notifiers scaffold command to generate an example notifier, and then copy the resource definition for your notifier type:

chronoctl notifiers scaffold

Define the resource definition for your webhook notifier:
```
api_version: v1/config
kind: Notifier
spec:
  name: NAME
  slug: SLUG
  skip_resolved: true
  webhook:
    - url: http://localhost:1234
```
Replace the following:
- NAME: A descriptive name, such as test-webhook.
- SLUG: A unique identifier, such as test-webhook.
Add a URL, called as a POST request, to the url key.
Apply the changes:
```
chronoctl apply -f FILE_NAME.yaml
```
Replace FILE_NAME with the name of your notifier YAML file.

To create a webhook notifier:

Create a webhook notifier with Terraform by using the chronosphere_webhook_alert_notifier type followed by a name in a resource declaration:

resource "chronosphere_webhook_alert_notifier" "webhook_notifier" {
  name = "Webhook Notifier"

  # Optional slug of the webhook notifier.
  slug = "webhook-notifier"

  # Notifier-specific required configuration
  # Detailed definitions can be found at: https://prometheus.io/docs/alerting/latest/configuration/#webhook_config
  url = "https://your-webhook-url"

  ## (Optional) Base configuration common to all notifiers
  send_resolved = true # The default value

  ## (Optional) HTTP configuration common to HTTP notifiers
  basic_auth_username = "username"
  basic_auth_password = "strong+p@ssword"
  # Can use bearer_token instead of basic auth
  proxy_url                = "https://my-proxy-url"
  tls_insecure_skip_verify = false
}

Add a URL, called as a POST request, to the url key.
Run terraform apply to create the notifier resource.
```
terraform apply
```

To complete this action with the Chronosphere API, use the webhook object in the CreateNotifier endpoint.Because the Chronosphere API requires authentication, include an API token with your curl request, as shown in the following example. For more details, see Create an API token.

export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"

curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
     -X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"

Replace the following:

TOKEN: Your API token.
INSTANCE: The subdomain name for your organization’s Observability Platform instance.
METHOD: The HTTP method to use with the request, such as GET or POST.
ENDPOINT_PATH: The specific endpoint you want to access.

Webhook notifier request body

The following example outlines the body for a POST request to a webhook. The request consists of one triggered alert called "test alert" that has several associated labels, such as component, instance, and job. This example contains several notable sections:

commonLabels: Contains labels that are common across all alerts in a notification display. Each alerting series includes the full list of labels. Any static labels that you define also display under commonLabels.
groupLabels: Contains label values for the related signal display, in addition to a "severity" for the label.
fingerprint: A representation of an alerting series, expressed as a deterministic value based on the hash of the labels.

{
  "notifier": "test webhook",
  "status": "firing",
  "alerts": [
    {
      "status": "firing",
      "labels": {
        "alertname": "test alert",
        "component": "remote_write",
        "instance": "localhost:3030",
        "job": "collector_binary",
        "severity": "critical",
        "pod_name": "prom-74cbfb46c9-2ftk9"
      },
      "annotations": {
        "ruleid": "32bb3fbe-c10b-44bb-a4c0-3d053f4a08cd",
        "monitor_slug": "test-monitor",
        "notification_policy_slug": "test-policy"
      },
      "startsAt": "2020-05-19T13:57:21.68227886Z",
      "endsAt": "0001-01-01T00:00:00Z",
      "fingerprint": "7424223989b20025"
    }
  ],
  "groupLabels": {
    "alertname": "test alert",
    "severity": "critical"
  },
  "commonLabels": {
    "alertname": "test alert",
    "component": "remote_write",
    "instance": "localhost:3030",
    "job": "collector_binary",
    "severity": "critical",
    "pod_name": "prom-74cbfb46c9-2ftk9"
  },
  "commonAnnotations": {
    "ruleid": "32bb3fbe-c10b-44bb-a4c0-3d053f4a08cd",
    "monitor_slug": "test-monitor",
    "notification_policy_slug": "test-policy"
  },
  "version": "4"
}

Webhook signatures

Chronosphere webhooks include cryptographic signatures to ensure the authenticity and integrity of webhook requests.

Headers

Every outbound webhook includes these security headers:

Chronosphere-Webhook-Timestamp: The Unix timestamp of the time the webhook request was constructed. For example, 1754255354.
Chronosphere-Webhook-Signature-V1: At least one hex-encoded signature. Multiple comma-separated signatures can be included in the event of key rotation. This string always contains at least one comma, even if there is only one signature. This ensures that clients are splitting the header value by commas. Example value (note trailing comma): 05908e247179fd822f2508907632cb1c57721691b688d72577a22dc46d183d21,.

Retrieve your signing key

If you are a member of a team with the SysAdmin role, you can retrieve your signing key in the Observability Platform web app.

Click your profile icon from the menu bar and select My Account.
The Webhook Signing Key field displays your key, but its value is hidden. Click the reveal icon to reveal its value, and then click the copy icon to copy its value to your clipboard.

Signature algorithm

Signatures are generated using the HMAC-SHA256 algorithm with the following process:

Construct the payload.

payload = "v1:" + timestamp + ":" + request_body

Generate the HMAC-SHA256 signature.

for i, key in active_signing_keys:
   signatures[i] = HMAC-SHA256(payload, key)

Set the hex encode.

header_value = join(hex_encode(signatures), ",") + ","

Verify the signature

To verify a Chronosphere webhook signature:

Extract the headers.
- Get the Chronosphere-Webhook-Timestamp header value. Ensure the timestamp is within some tolerance. Chronosphere recommends a tolerance of five to 15 minutes.
- Get the Chronosphere-Webhook-Signature-V1 header value.
- Fail if either header is missing.
Read the request body.
- Read the complete HTTP request body as bytes.
- Preserve the exact bytes. Disable any automatic parsing or formatting in your HTTP client.
Construct the verification payload. Construct a verification payload using the following syntax:
```
verification_payload = "v1:" + timestamp + ":" + request_body
```
Generate the expected signature.
- Use HMAC-SHA256 with your signing key.
- Hex-encode the result (lowercase).
Compare signatures.
- Split the signature header on commas.
- Trim whitespace from each signature.
- Skip empty values.
- Use constant-time comparison for each signature.
- Accept if any signature matches.

Code sample

Webhook IP addresses

Chronosphere has established a list of static IP addresses which serve outbound webhook notification traffic. Use these addresses in your company’s allowlist to restrict traffic and maintain security. Chronosphere also provides a full list of IP addresses. Chronosphere doesn’t offer a published CIDR range. Chronosphere Observability Platform serves outbound webhook traffic for the following regions:

The following IP addresses serve traffic for the United States:

104.198.2.151
34.122.142.108
34.122.149.117
34.122.224.78
34.127.109.43
34.135.53.117
34.145.80.163
34.16.24.232
34.168.147.207
34.168.150.81
34.171.52.135
34.173.251.109
34.28.62.245
34.29.130.124
34.29.185.167
34.41.168.213
34.70.121.15
34.82.119.158
34.82.143.37
34.82.179.176
34.82.243.234
34.83.169.174
34.83.7.178
34.83.75.236
35.188.223.136
35.188.42.84
35.197.55.241
35.225.28.124
35.227.141.247
35.230.72.253
35.233.215.68
35.239.112.38

Last updated: 2025.03.31

Observability Platform

Telemetry Pipeline

Tools

More information

Webhook notifier request body

Webhook signatures

Headers

Retrieve your signing key

Signature algorithm

Verify the signature

Code sample

Webhook IP addresses

Observability Platform

Telemetry Pipeline

Tools

More information

​Webhook notifier request body

​Webhook signatures

​Headers

​Retrieve your signing key

​Signature algorithm

​Verify the signature

​Code sample

​Webhook IP addresses

Webhook notifier request body

Webhook signatures

Headers

Retrieve your signing key

Signature algorithm

Verify the signature

Code sample

Webhook IP addresses