Signed webhooks

Send page changes to a webhook you control.

Put an HTTPS URL on a monitor. When the visible text changes, the fetch fails or recovers, or the certificate is near expiry, SignalWatch POSTs a signed JSON event. Slack and Discord URLs get a readable message instead.

No card required. Webhooks are included on the free plan. Add the endpoint in the dashboard after the monitor exists — you do not need it to sign up.

Events

• content.changed — unified diff, change_ratio, content_hash, and a short excerpt.
• check.down — error and status_code when the fetch fails.
• check.up — the URL responds again.
• cert.expiring — cert_days_left, cert_not_after, and cert_issuer. Once inside 14 days, again inside 3.
• test — what Send test alert delivers, so you can map fields before a real change.

Every payload also includes check_id, name, url, status_code, and detected_at. A worked curl, Python, and n8n version is on the examples page.

A content-change body

{
  "event": "content.changed",
  "check_id": 42,
  "name": "Changelog",
  "url": "https://example.com/changelog",
  "status_code": 200,
  "detected_at": "2026-10-03T12:00:00+00:00",
  "content_hash": "…",
  "change_ratio": 0.04,
  "diff": "-1.8.0\n+1.9.0\n"
}

Presentation example. The diff is truncated for delivery. The dashboard keeps a longer copy for 45 days.

Signature

Each delivery sets:

• X-SignalWatch-Event — the event name
• X-SignalWatch-Timestamp — unix seconds
• X-SignalWatch-Delivery — an id for this attempt
• X-SignalWatch-Signature — sha256= HMAC-SHA256 of timestamp + "." + raw body, using the per-account webhook secret

Compare the header with a constant-time check. The secret is on the dashboard under Webhook signing secret. Rotate the API key separately. The API key does not sign webhooks.

Failed deliveries retry. Use Send test alert if your endpoint returns an error. The dashboard reports the HTTP status or the error string.

Slack and Discord

Paste an incoming webhook URL from Slack (hooks.slack.com) or Discord. Those hosts receive a headline, the URL, and a fenced diff, because they do not render an arbitrary JSON event as a chat message. Signature headers are still present. Any other HTTPS URL receives the JSON above.

Create monitors from the REST API with X-API-Key if the dashboard is the wrong place. The API is on every plan, including Free (3 monitors, 15-minute checks). Faster checks are on Pro and Business.

Related: code examples, TLS expiry, competitor pricing.