Webhook events

The envelope, event types, signature headers, retry schedule and automatic switch-off rules for outbound webhooks.

A webhook endpoint receives one JSON body per delivery. This page lists the event types, the headers that prove the delivery came from Logable, the retry schedule, and when Logable switches an endpoint off by itself.

Envelope#

{
  "id": "e1a2c3d4-5f6a-4b7c-8d9e-0f1a2b3c4d5e",
  "type": "alert.fired",
  "api_version": "2026-08-12",
  "created_at": "2026-07-01T10:00:00.000Z",
  "organization_id": "9c8b7a6f-5e4d-3c2b-1a0f-9e8d7c6b5a4f",
  "data": {
    "alert": {
      "id": "3f2e1d0c-9b8a-4776-8654-3f2e1d0c9b8a",
      "severity": "warning",
      "title": "Raw Meal Silo is low",
      "message": "weight is below 20000 kg"
    },
    "rule": {
      "id": "7a6b5c4d-3e2f-4190-8a7b-6c5d4e3f2a1b",
      "name": "Low stock"
    },
    "device": {
      "id": "0d9f7f52-3a1c-4a6e-9b2d-1f4e5a6b7c8d",
      "name": "Raw Meal Silo"
    },
    "reading": {
      "metric": "weight",
      "value": 18750.5,
      "threshold": 20000
    }
  }
}

device and stream never both appear. A rule with no metric, such as a status condition, carries no reading.

Event types#

Event types
Type	Kind	Description
alert.fired	event	A rule's condition was met and an alert opened. data carries alert, rule, device or stream, and reading when the condition has a metric.
alert.recovered	event	The alert's recovery condition was met, or the alert was resolved. Same data shape as alert.fired.
endpoint.test	event	Sent by the Send test event action. data is empty.

Headers#

Every delivery carries three headers: webhook-id, webhook-timestamp, webhook-signature. webhook-id matches the envelope's own id. webhook-timestamp is unix seconds. webhook-signature starts with a v1, prefix, then a base64 HMAC-SHA256 of the string id.timestamp.body, keyed with your endpoint's secret. See Receive alerts as an HTTP call for the verification code.

Retries#

A failed delivery retries on a fixed schedule. Logable does not honor a Retry-After header from your endpoint.

Retry schedule
Attempt	Delay	Description
Attempt 1	immediately	The first delivery.
Attempt 2	5 seconds	Waited after attempt 1 failed.
Attempt 3	5 minutes	Waited after attempt 2 failed.
Attempt 4	30 minutes	Waited after attempt 3 failed.
Attempt 5	2 hours	Waited after attempt 4 failed.
Attempt 6	5 hours	Waited after attempt 5 failed.
Attempt 7	10 hours	Waited after attempt 6 failed.
Attempt 8	10 hours	Waited after attempt 7 failed.

Automatic switch-off#

Logable switches a failing endpoint off by itself, so a dead endpoint does not keep retrying forever. Logable never switches an endpoint back on by itself. Fix the receiver, send a test event, then turn it back on.

Automatic switch-off
Condition	Value	Description
consecutive exhausted deliveries	5	Deliveries that ran the whole retry curve without a 2xx, back to back. Each one is about 28 hours of trying.
consecutive private-address resolutions	3	The endpoint URL resolved to a private or reserved address. A failed DNS lookup does not count.
days without a success	5 days	Counted from the last 2xx while deliveries keep failing.

Replay#

Replaying a delivery from its log sends the same data again, with a new id and a new signature. Your endpoint sees it as a fresh delivery.