Webhooks, Slack and Teams — Apirelio Documentation

Connect

Choose a destination.

Open Integrations for a project, add a destination and select the events it should receive.

Slack

Create an Incoming Webhook for a channel and paste its secret URL into Apirelio.

Microsoft Teams

Create a workflow using “When a Teams webhook request is received” and paste its callback URL.

{}

Generic HTTPS

Receive the complete JSON event and authenticate it with the one-time signing secret.

Example Apirelio high error rate alert delivered to a Slack channel — **Slack**Block Kit message in a channel

Example Apirelio high error rate alert delivered to a Microsoft Teams channel — **Microsoft Teams**Adaptive Card posted by a workflow

Example appearance. Spacing and surrounding interface may vary by Slack or Teams client version.

Keep destination URLs secret

Apirelio encrypts destination URLs at rest and never returns the full value after creation.

Lifecycle

Subscribe only to useful signals.

alert.opened is emitted when a rule creates a new occurrence. alert.resolved is emitted after manual or automatic resolution. A test delivery uses webhook.test.

Generic webhook payloadjson

{
  "id": "4fb12df7-…",
  "version": "1",
  "type": "alert.opened",
  "created_at": "2026-08-07T18:30:00Z",
  "project": {
    "id": 42,
    "name": "Billing API",
    "environment": "production"
  },
  "data": {
    "alert": {
      "severity": "critical",
      "title": "Acme has a high error rate",
      "description": "28.4% of requests failed during the last 60 minutes."
    }
  }
}

Authenticity

Verify the raw request body.

Generic deliveries include X-Apirelio-Event, X-Apirelio-Delivery and X-Apirelio-Signature. The signature is a SHA-256 HMAC of the exact raw JSON body.

Node.js verificationtypescript

import { createHmac, timingSafeEqual } from 'node:crypto'

const expected = 'sha256=' + createHmac('sha256', process.env.APIRELIO_WEBHOOK_SECRET)
  .update(rawRequestBody)
  .digest('hex')

const valid = timingSafeEqual(
  Buffer.from(request.headers['x-apirelio-signature']),
  Buffer.from(expected),
)

Secret rotation

Rotating a secret invalidates the previous value immediately. Update the receiver before sending another test.

Reliability

Retries without duplicate alert creation.

Delivery happens asynchronously and never blocks alert evaluation. Failed requests are retried after 1, 5 and 30 minutes. Redirects are not followed, destinations are revalidated before every attempt and the latest 30 days of status codes are available in Delivery history.

Receivers should use X-Apirelio-Delivery as an idempotency key because network failures can cause the same event to be attempted more than once.

Put customer-impact alerts where your team works.