Webhook notifications are intended for your own systems that support verification and signature validation. An unmodified Slack or Discord incoming webhook is therefore not directly compatible.
Verify destination
Enter a public HTTPS URL with the standard port 443. Your endpoint receives a POST with Content-Type application/json:
{"type":"debugteam.verification","challenge":"zufälliger-wert"}
Respond within ten seconds with HTTP 200 and the same challenge value:
{"challenge":"zufälliger-wert"}
The challenge is not a security alert. The destination is enabled for alerts only after a successful response. Redirects are not followed. Internal addresses and reserved networks are blocked.
Receive events
A message contains a stable event ID, a type and a data object with the website, observation time and event details. Security advisories include available source and license information, version ranges and fix guidance.
{"id":"eindeutige-ereignis-id","type":"website_down","data":{"event":"website_down","site":"https://example.org/","observed_at":0}}
This is a fictional structural example, not an actual outage.
Verify signature
The signing secret is available only in your protected account area. Use the raw HTTP body and the X-DebugTeam-Timestamp, X-DebugTeam-Id and X-DebugTeam-Signature headers.
signierte_daten = zeitstempel + "." + roher_body signatur = HMAC_SHA256(signiergeheimnis, signierte_daten) erwarteter_header = "sha256=" + signatur_als_hex
Compare signatures in constant time, accept only a short time window and deduplicate by event ID. Respond to successfully accepted messages with a 2xx status. Keep the secret out of browser code and public repositories.
Retries
Failed deliveries are attempted up to six times, with increasing intervals. The same event ID is retained. An interrupted connection may cause a duplicate delivery. Your account area shows the number of failed deliveries.