Webhook Alerts
Get notified via webhook when important events occur in your app. Works with Slack, Teams, Discord, PagerDuty, or any HTTPS endpoint.
Webhook alerts are available on the Growth plan.
How it works
SignalVault POSTs a JSON payload to your webhook URL whenever a matching event is ingested. Alerts never block or delay event ingestion — they are sent asynchronously.
Slack auto-detection: if your URL contains hooks.slack.com,
SignalVault sends a rich Block Kit message.
All other HTTPS URLs receive a plain JSON payload with the same fields.
Email and webhook alerts are independent — you can enable either or both. They share the same event type filters, minimum severity, and cooldown settings.
Setup
- Get a webhook URL from your platform. For Slack: go to api.slack.com/apps, enable Incoming Webhooks, and copy your URL. For other platforms: create an incoming webhook or HTTP endpoint as your service requires.
- Paste it into SignalVault. Open Settings → Webhooks, find the Alerts card, toggle webhook alerts on, and paste your URL.
- Configure what triggers an alert. Choose which event types and minimum severity should fire a notification, and set a cooldown to avoid noise.
- Save.
Supported event types
| Event Type | Description |
|---|---|
| policy.violation | A guardrail rule was triggered |
| budget.exceeded | A cost or token budget limit was breached |
| ai.error | An AI provider error or timeout occurred |
Configuration options
| Setting | Default | Description |
|---|---|---|
| Enabled | Off | Master toggle for webhook alerts |
| Webhook URL | — | Any HTTPS URL. Slack URLs receive Block Kit; all others receive plain JSON. |
| Event types | None | Which event types trigger a notification |
| Minimum severity | 1 (all) | Only alert on violations at or above this level (1–10) |
| Cooldown | 15 min | Minimum time between notifications (1–1440 min) |
Cooldown
The cooldown is shared across both email and webhook — one alert sent via either channel resets the timer. This prevents a burst of events from flooding both channels simultaneously.
The webhook URL is encrypted at rest and is not shown again in the dashboard once saved. Note that alert deliveries are not signed: there is no HMAC header for your endpoint to verify, so anyone who learns the URL could post to it. Treat the URL itself as the secret, and prefer an endpoint that does not act on an alert without further checks.