Notifications

What is a notification channel?

A notification channel is a destination where alert messages are delivered when an alert opens or resolves. Each channel type has its own setup, from a simple email address to a webhook endpoint with HMAC signature verification.

How an alert reaches channels depends on whether an escalation policy governs it. If a policy governs the alert, escalation pages targets step by step over time. If no policy governs it (broadcast), every enabled channel is notified, and each channel still has to pass its filters (workspace event matrix, per-channel events filter, personal preferences, quiet hours, and 5-minute deduplication). See Alert & incident flow for the full picture, including quiet hours and your personal notification chain.

Available channels

HowlOps also accepts inbound alerts (5 sources) that create alerts: Alertmanager, Grafana, Datadog, CloudWatch, and a generic webhook. Inbound alerts are deduplicated on their fingerprint: a repeat of the same fingerprint bumps an occurrence counter rather than opening a new alert.

Alert sensitivity and recovery

The alert threshold on each monitor controls how many consecutive failures fire an alert, and recovery alerts travel back the same delivery path when a monitor heals. Both are configured per monitor, not per channel. See Step 1: where alerts come from and Step 6: recovery and resolve for exactly how thresholds, retries, and recovery opt-out work.

Webhook payload

When an alert fires on a custom webhook channel, the platform sends a JSON payload:

{
  "version":      "1",
  "event":        "monitor.down",
  "monitor_name": "Production API",
  "url":          "https://api.example.com/health",
  "details":      "HTTP 503 - Service Unavailable",
  "timestamp":    "2026-05-13T10:00:00Z",
  "tenant_id":    "00000000-0000-0000-0000-000000000000",
  "monitor_id":   "00000000-0000-0000-0000-000000000001",
  "heartbeat_id": "",
  "incident_id":  "00000000-0000-0000-0000-000000000002",
  "severity":     "critical",
  "status_code":  503,
  "region":       "nbg1"
}

The example above is abbreviated. Every delivery also carries response_ms, monitor_type, tags, responder, and runbook_url, plus affected_count for correlated mass-outage events. See the Webhooks reference for the complete field list and per-event examples.

Event types

For heartbeat events, heartbeat_id is populated and monitor_id is empty. For ping monitors, the url field contains ping://HOST.

Webhook signature verification

When your webhook channel is configured with a signing secret, each request includes an X-HowlOps-Signature header, an HMAC-SHA256 hex digest of the raw request body, signed with that secret. Verify it server-side to reject forged requests. See Webhooks reference, Signature verification for why it's there, the exact header format, and copy-pasteable Python and TypeScript examples.

Testing channels

Always test a channel before relying on it for production alerts. After adding a channel, click Send Test Alert in the channel settings. Verify the message arrives at the destination.

How alerts reach channels

There is no per-monitor "assign this channel" list. Channels are configured once at the workspace level, and every alert is routed to them by the same rules:

• If an escalation policy governs the alert (chosen by a routing rule, the monitor's own policy, or the workspace default), the escalation engine pages targets step by step. Individual channels are reached only when a step names them.
• If no policy governs the alert (broadcast), every enabled channel is notified, and each one still has to pass its own filters (workspace event matrix, per-channel events, personal preferences, quiet hours, and deduplication).

To send some monitors down a different path than others, use routing rules (match on monitor type, tag, severity, or labels) rather than attaching channels to monitors. See Alert & incident flow for the full precedence and filter chain.

Related

• Concepts: Alert & incident flow
• Concepts: Escalation
• Tutorials: Set up Slack alerts
• Reference: Integrations