Overview
Webhooks push events to your own backend the moment something happens — a failed check, a recovery, a new incident. Point them at any HTTPS endpoint to wire Brook into your on-call tooling, internal dashboards, or automated runbooks.
Webhooks are one of Brook's alert channels, alongside email, Slack, and Discord.
Events
Subscribe to any of these event types:
| Event | Fires when |
|---|---|
| check.failed | A test call returns a failed verdict. |
| check.recovered | A monitor returns to good after a failure. |
| monitor.degraded | A monitor enters the working state. |
| incident.created | Repeated failures open an incident. |
| incident.resolved | An open incident is resolved. |
Payload
Every delivery is a JSON POST with a consistent envelope:
{
"event": "check.failed",
"monitor": {
"id": "mon_3k9",
"name": "Support line",
"number": "+14155550142"
},
"check": {
"id": "chk_88b",
"verdict": "failed",
"reason": "no_answer",
"latency_ms": null,
"at": "2026-06-12T10:05:00Z"
}
}Verifying signatures
Each request includes an X-Brook-Signature header — an HMAC-SHA256 of the raw body, keyed with your endpoint's signing secret. Verify it before trusting a payload.
const crypto = require("crypto");
function verify(req) {
const sig = req.headers["x-brook-signature"];
const expected = crypto
.createHmac("sha256", process.env.BROOK_SIGNING_SECRET)
.update(req.rawBody)
.digest("hex");
return crypto.timingSafeEqual(
Buffer.from(sig),
Buffer.from(expected)
);
}Setting one up
- In the dashboard, open Alerts → Webhooks and add your HTTPS endpoint URL.
- Copy the signing secret Brook generates and store it as an environment variable.
- Choose which events the endpoint should receive.
- Send a test event and confirm your endpoint returns a 2xx.
Retries & delivery
We consider any 2xx response a success. If your endpoint errors or times out, Brook retries with exponential backoff for up to 24 hours. Respond quickly and do heavy work asynchronously so deliveries don't time out.