# Webhook events (https://logable.app/docs/reference/webhook-events)

The envelope, event types, signature headers, retry schedule and automatic switch-off rules for outbound webhooks.



A webhook endpoint receives one JSON body per delivery. This page lists the event types, the headers that prove the delivery came from Logable, the retry schedule, and when Logable switches an endpoint off by itself.

## Envelope [#envelope]

```json
{
  "id": "e1a2c3d4-5f6a-4b7c-8d9e-0f1a2b3c4d5e",
  "type": "alert.fired",
  "api_version": "2026-08-12",
  "created_at": "2026-07-01T10:00:00.000Z",
  "organization_id": "9c8b7a6f-5e4d-3c2b-1a0f-9e8d7c6b5a4f",
  "data": {
    "alert": {
      "id": "3f2e1d0c-9b8a-4776-8654-3f2e1d0c9b8a",
      "severity": "warning",
      "title": "Raw Meal Silo is low",
      "message": "weight is below 20000 kg"
    },
    "rule": {
      "id": "7a6b5c4d-3e2f-4190-8a7b-6c5d4e3f2a1b",
      "name": "Low stock"
    },
    "device": {
      "id": "0d9f7f52-3a1c-4a6e-9b2d-1f4e5a6b7c8d",
      "name": "Raw Meal Silo"
    },
    "reading": {
      "metric": "weight",
      "value": 18750.5,
      "threshold": 20000
    }
  }
}
```

`device` and `stream` never both appear. A rule with no metric, such as a status condition, carries no `reading`.

## Event types [#event-types]

| Type | Kind | Description |
| --- | --- | --- |
| alert.fired | event | A rule's condition was met and an alert opened. data carries alert, rule, device or stream, and reading when the condition has a metric. |
| alert.recovered | event | The alert's recovery condition was met, or the alert was resolved. Same data shape as alert.fired. |
| endpoint.test | event | Sent by the Send test event action. data is empty. |

## Headers [#headers]

Every delivery carries three headers: `webhook-id`, `webhook-timestamp`, `webhook-signature`. `webhook-id` matches the envelope's own `id`. `webhook-timestamp` is unix seconds. `webhook-signature` starts with a `v1,` prefix, then a base64 HMAC-SHA256 of the string `id.timestamp.body`, keyed with your endpoint's secret. See [Receive alerts as an HTTP call](/docs/integrate/webhooks-out) for the verification code.

## Retries [#retries]

A failed delivery retries on a fixed schedule. Logable does not honor a `Retry-After` header from your endpoint.

| Attempt | Delay | Description |
| --- | --- | --- |
| Attempt 1 | immediately | The first delivery. |
| Attempt 2 | 5 seconds | Waited after attempt 1 failed. |
| Attempt 3 | 5 minutes | Waited after attempt 2 failed. |
| Attempt 4 | 30 minutes | Waited after attempt 3 failed. |
| Attempt 5 | 2 hours | Waited after attempt 4 failed. |
| Attempt 6 | 5 hours | Waited after attempt 5 failed. |
| Attempt 7 | 10 hours | Waited after attempt 6 failed. |
| Attempt 8 | 10 hours | Waited after attempt 7 failed. |

## Automatic switch-off [#automatic-switch-off]

Logable switches a failing endpoint off by itself, so a dead endpoint does not keep retrying forever. Logable never switches an endpoint back on by itself. Fix the receiver, send a test event, then turn it back on.

| Condition | Value | Description |
| --- | --- | --- |
| consecutive exhausted deliveries | 5 | Deliveries that ran the whole retry curve without a 2xx, back to back. Each one is about 28 hours of trying. |
| consecutive private-address resolutions | 3 | The endpoint URL resolved to a private or reserved address. A failed DNS lookup does not count. |
| days without a success | 5 days | Counted from the last 2xx while deliveries keep failing. |

## Replay [#replay]

Replaying a delivery from its log sends the same data again, with a new `id` and a new signature. Your endpoint sees it as a fresh delivery.

## Read next [#read-next]

* [Receive alerts as an HTTP call](/docs/integrate/webhooks-out)
* [Send alerts to a webhook](/docs/guides/alerts/send-alerts-to-a-webhook)