Notification Channels

Manage how and where alerts are delivered. Channels can be organization-level (default for all customers), customer-level (override for a specific customer), or website-level (override for a specific monitor).

Authentication

All examples assume a bearer token:

BASE_URL="https://uptimeify.io"
TOKEN="<your-api-token>"

Channel Types and Config

Each channel type has a specific config structure:

Secrets (webhook secret, Slack/Discord URLs, PagerDuty routing keys, Pushover credentials, Opsgenie API keys) are encrypted at rest and redacted in API responses (replaced with null, with hasSecret: true flags).

Webhook Signature Verification

When a secret is configured on a webhook channel, Uptimeify signs outgoing payloads so receivers can verify authenticity.

Algorithm: HMAC-SHA256

Header: X-Webhook-Signature — hex-encoded HMAC-SHA256 digest

Companion headers sent with every webhook:

Verification steps:

1. Read the raw request body as a string (do not parse as JSON first).
2. Compute HMAC-SHA256 using the secret you configured in the channel as the key and the raw body string as the message.
3. Compare the result (hex-encoded) with the value of the X-Webhook-Signature header using a constant-time comparison.
4. Optionally check X-Webhook-Timestamp for replay protection.

// Node.js verification example
const crypto = require('crypto')

function verifySignature(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  )
}

# Python verification example
import hmac, hashlib

def verify_signature(raw_body, signature, secret):
    expected = hmac.new(
        secret.encode('utf-8'),
        raw_body.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

Scope Resolution

When listing channels, the scope determines which channels are returned:

• Organization-level (organizationId only, no customerId/websiteId): Default channels for all customers
• Customer-level (customerId set, no websiteId): Customer-specific overrides
• Website-level (websiteId set): Per-monitor overrides

Endpoints

• List Notification Channels
• Create Notification Channel
• Update Notification Channel
• Delete Notification Channel
• Test Notification Channel