Uptime alert delivered to your webhook

POST

What NSIN sends to the webhook URL saved with PUT /uptime/settings (webhook_url, notify_webhook: true): one outage.opened when an incident opens on the domain, one outage.resolved when it resolves, and test for POST /uptime/webhook/test. Each incident sends each event at most once.

Verify every request. X-Nsin-Signature is sha256=<hex HMAC-SHA256> of <X-Nsin-Timestamp>.<raw body>, keyed with the domain’s signing secret (GET /uptime/webhook). The timestamp is inside the MAC, so reject requests whose timestamp is too old to stop replays.

Answer with any 2xx within 5 seconds. Anything else — another status, a timeout, a connection error — is retried twice, after 5 and 30 seconds. Redirects are not followed, and a URL that resolves to a private or otherwise disallowed address is refused without retrying. Every delivery is listed in GET /uptime/webhook/deliveries.

Parameters

Header Parameters

X-Nsin-Event

required

string

Allowed values: outage.opened outage.resolved test

The event name, repeated from the body.

X-Nsin-Timestamp

required

string

Example

1759050000

When the request was signed, in unix seconds.

X-Nsin-Signature

required

string

sha256= followed by the hex HMAC-SHA256 of <timestamp>.<raw body>.

User-Agent

string

Allowed value: Nsin-Uptime-Webhook/1

Always Nsin-Uptime-Webhook/1.

Request Body ^required

Media type application/json

The JSON body POSTed to a domain’s uptime webhook.

Every request carries X-Nsin-Event, X-Nsin-Timestamp (unix seconds) and X-Nsin-Signature: sha256=<hex>, the HMAC-SHA256 of <timestamp>.<raw body> keyed with the domain’s signing secret. Answer with any 2xx within 5 seconds. Anything else is retried twice (after 5 s and 30 s). Redirects are not followed. Each incident sends each event at most once.

object

event

What happened. test for POST /uptime/webhook/test.

string

Allowed values: outage.opened outage.resolved test

incident_id

The incident this event is about. 0 on test.

integer

domain

string

hostname

string

monitor_id

null for the default whole-host watch.

integer | null

scope

The monitor’s name or path; empty for the whole-host watch.

string

peak_error_pct

Highest per-minute origin-error percentage seen in the incident.

number

started_at

When the incident opened.

string format: date-time

resolved_at

When it resolved. null on outage.opened.

string | null format: date-time

duration_sec

How long it lasted, in seconds. null until resolved.

integer | null

sent_at

When this delivery was signed — the same instant as X-Nsin-Timestamp.

string format: date-time

Responses

2XX

Delivery accepted. Any other answer counts as a failure and is retried.