Skip to main content
Send alerts from a monitoring tool that supports the JSON format below. For incident.io, CloudWatch, Datadog, or Honeycomb, start with the matching webhook type.

​
Prerequisites

You need permission to add webhooks in Corelayer and a tool that can POST JSON to the webhook URL.

​
Setup

​
1. Create a source

Open Webhooks and click Add Webhook. Set Webhook type to Custom Webhook, enter a Source name such as Checkout alerts, and click Create Webhook. Copy the Webhook URL, Webhook token, and Example request. The token is shown once, so store it before clicking Done.

​
2. Configure your alert sender

Set your monitoring tool to POST the JSON alert payload to the webhook URL with these headers:
The URL must be reachable from the sender. For customer-hosted Corelayer, a private URL works when the sender is on the same network. Cloud-hosted senders need access from their own network.

​
3. Send an example alert

Run the example curl request from a machine that can reach the endpoint. Use the current timestamp when sending a new example. This sends a real alert and can start an investigation. A 202 response means the request was accepted; read its status field to see whether it was queued, ignored as a duplicate, or skipped. For a queued alert, check Corelayer for the resulting investigation.

​
Alert payload

Send one alert per request. Use the alert’s actual timestamp for time:

​
Required fields

​
Optional fields

​
Map your payload

If your tool supports a custom payload template, map its fields to this format. Set action to trigger when the alert fires and resolve when it recovers. Use a stable fingerprint for repeated notifications of the same alert. Omit optional fields that have no value. For example, severity: "" is invalid; omit severity to use info.

​
How alerts are handled

  • trigger sends the alert for investigation.
  • Repeated triggers with the same fingerprint are accepted but ignored during the deduplication window.
  • resolve and acknowledge are recorded but do not automatically close Corelayer issues.
See Manage sources to change or remove this source.

​
Troubleshooting

​
The sender cannot reach the endpoint

Check the URL and network access from the system sending alerts. For a private deployment, test from that network rather than your laptop.

​
The endpoint returns an error

​
No investigation starts

Read the response’s status. A duplicate trigger is ignored, and resolution or acknowledgement events are only recorded. If it reports skipped_onboarding, complete your organization’s onboarding and send a new alert. Need help? Contact support.