hostnag

Signed webhooks for every alert

hostnag posts a signed JSON payload for every alert to any https endpoint you name.

Start freeSee pricing

Included on Pro and Business.

PlansFreeProBusiness

Down

Headers
x-hostnag-event
x-hostnag-timestamp
x-hostnag-signature
Body
{
  "version": 3,
  "id": "ev-6",
  "type": "alert.down",
  "severity": "critical",
  "title": "[Critical] https://www.example.com/ is down",
  "summary": "Down from 2 of 3 locations (US East, Frankfurt). Last error: unexpected_status: 503.",
  "createdAt": "2026-09-12T08:00:00.000Z",
  "threshold": null,
  "daysLeft": null,
  "expiresAt": null,
  "details": {
    "downSince": "2026-09-12T07:58:00.000Z",
    "durationMinutes": 2,
    "reminder": false,
    "failedLocations": [
      "iad1",
      "fra1"
    ],
    "totalLocations": 3,
    "lastError": "unexpected_status: 503",
    "statusCode": 503
  },
  "monitor": {
    "id": "mon-3",
    "name": "Marketing site",
    "target": "https://www.example.com/",
    "type": "http",
    "lastError": null,
    "issuer": null,
    "registrar": null,
    "fingerprint256": null
  },
  "group": {
    "name": "Client A"
  },
  "org": {
    "name": "Acme"
  },
  "url": "https://hostnag.com/acme/monitors/mon-1",
  "ackUrl": "https://hostnag.com/ack/abababababababababababababababababababababababababababababababab",
  "acknowledgedAt": null,
  "tier": 0
}

Set up

  1. 01

    Add the endpoint

    Any https:// URL that can receive a POST request.

  2. 02

    Verify each request

    Every POST carries x-hostnag-event, x-hostnag-timestamp and x-hostnag-signature headers: an HMAC-SHA256 sha256= digest over the timestamp and body, version 3 payload. Leave the signing secret blank to have hostnag generate one.

What arrives

Rendered by the same code that sends it.
Payloadversion 3

Back up

Headers
x-hostnag-event
x-hostnag-timestamp
x-hostnag-signature
Body
{
  "version": 3,
  "id": "ev-8",
  "type": "alert.up",
  "severity": "info",
  "title": "[Recovered] https://www.example.com/ is back up after 1 h 15 min",
  "summary": "https://www.example.com/ answered again from every location. It was down for 1 h 15 min.",
  "createdAt": "2026-09-12T08:00:00.000Z",
  "threshold": null,
  "daysLeft": null,
  "expiresAt": null,
  "details": {
    "downSince": "2026-09-12T07:58:00.000Z",
    "durationMinutes": 75
  },
  "monitor": {
    "id": "mon-3",
    "name": "Marketing site",
    "target": "https://www.example.com/",
    "type": "http",
    "lastError": null,
    "issuer": null,
    "registrar": null,
    "fingerprint256": null
  },
  "group": {
    "name": "Client A"
  },
  "org": {
    "name": "Acme"
  },
  "url": "https://hostnag.com/acme/monitors/mon-1",
  "ackUrl": "https://hostnag.com/ack/abababababababababababababababababababababababababababababababab",
  "acknowledgedAt": null,
  "tier": 0
}

New certificate in the logs

Headers
x-hostnag-event
x-hostnag-timestamp
x-hostnag-signature
Body
{
  "version": 3,
  "id": "ev-ct-1",
  "type": "alert.changed",
  "severity": "warning",
  "title": "[Warning] New certificate for example.com",
  "summary": "Seen in certificate transparency logs: ZeroSSL RSA Domain Secure Site CA for example.com, www.example.com, issued 10 Sept 2026. Expected: no. If you did not order this, check who has access to your DNS and your CA account.",
  "createdAt": "2026-09-12T08:00:00.000Z",
  "threshold": null,
  "daysLeft": 60,
  "expiresAt": null,
  "details": {
    "change": "ct_cert",
    "from": null,
    "to": "ZeroSSL RSA Domain Secure Site CA | example.com, www.example.com | 2026-09-10T00:00:00.000Z | unexpected"
  },
  "monitor": {
    "id": "mon-7",
    "name": "CT watch",
    "target": "example.com",
    "type": "ct_watch",
    "lastError": null,
    "issuer": null,
    "registrar": null,
    "fingerprint256": null
  },
  "group": {
    "name": "Client A"
  },
  "org": {
    "name": "Acme"
  },
  "url": "https://hostnag.com/acme/monitors/mon-1",
  "ackUrl": "https://hostnag.com/ack/abababababababababababababababababababababababababababababababab",
  "acknowledgedAt": null,
  "tier": 0
}

Routing

Every alert follows the group's alert policy: which channels a route goes to and the minimum severity each one takes, in bands of critical, warning and info. Quiet hours hold non-critical alerts for email, Slack, Discord, SMS, Teams and Telegram until the window closes, then deliver one digest; critical alerts are never held, and webhook, PagerDuty and Opsgenie always deliver right away since they hand off to another machine, not a person. A maintenance window on a group or a monitor suppresses alerts for its duration while checks keep running. An alert nobody acknowledges escalates through up to three tiers, each after its own number of minutes, and can be acknowledged with one tap from the alert message itself.

Questions

How do I verify a request came from hostnag?

Recompute the HMAC-SHA256 of the timestamp and body with your signing secret and compare it to the sha256= value in x-hostnag-signature.

What happens on a breaking payload change?

The version number in the body increases; version 3 is current.

Watches

Alerting and status pagesEvery alert routed to the right channel at the right severity, held during quiet hours and maintenance, escalated until it's acknowledged.Uptime monitoringWebsites, APIs and anything that answers on a port, checked every minute from up to four places, with a failure confirmed before anyone is paged.Certificate transparency watchEvery certificate anyone issues for your domain, watched in the public logs before you'd otherwise hear about it.

Add a host. Hear about it in Webhook.

Start free