Webhook Integration
When a webhook fires
On every event a webhook channel is attached to: a monitor going down, recovering, an SSL certificate entering its warning window, or a heartbeat check going overdue or recovering. Each request is a single JSON POST body describing exactly one event.
Verifying the signature
Every request carries an X-Dumza-Signature header — an HMAC-SHA256 hex digest of the raw request body, signed with the channel's own secret (visible once when you create the channel, and again any time you regenerate it). Recompute the same HMAC over the exact bytes you received and compare it to the header to confirm the request genuinely came from Dumza and wasn't tampered with in transit.
Regenerating the secret
If a webhook secret ever leaks, regenerate it from the channel's settings — the URL and channel keep working, only the signing key changes, so update whatever you use to verify signatures on your end at the same time.