Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.guardway.ai/llms.txt

Use this file to discover all available pages before exploring further.

What this is for

Settings → Notifications lets you push gateway events to any HTTPS endpoint and create alert rules that fire into those endpoints when conditions cross a threshold. Use it to feed SIEM tools, page on-call, drop budget warnings into Slack, or replicate audit events into your own pipeline. The page has two sections: Alert Rules (conditions that trigger notifications) and Webhook Endpoints (where the notifications go).

Options

Webhook Endpoints

Create Webhook form:
FieldNotes
NameDisplay label (e.g. Slack Notifications).
URLHTTPS endpoint that receives the POST (e.g. https://example.com/webhook).
EventsMulti-select from the webhook event catalog. Pick only the events this endpoint should receive.
SecretShared secret used to compute the X-Guardway-Signature HMAC header.
Timeout (ms)How long the gateway waits before declaring a delivery failed.
Max RetriesMaximum retry attempts on 5xx and network errors (exponential backoff).

Available events

Events are grouped by category. Common ones:
EventWhen it fires
request.completedA request finished successfully.
request.failedA request failed.
request.rate_limitedA request was rate-limited.
latency.thresholdp95/p99 or moving average crossed your SLA.
quota.thresholdA budget or request threshold was crossed (50 / 80 / 100 %).
quota.exceededA budget or request limit was exceeded and the request was blocked.
guardrail.violationA guardrail policy blocked or redacted a request.
audit.actionAn administrative action was recorded on the platform.

Alert Rules

Create Alert form:
FieldNotes
NameDisplay label (e.g. High Error Rate).
ConditionFree-text condition expression (e.g. error_rate > 5%).
ThresholdNumeric or human threshold the condition compares against (e.g. 100 requests).
SeverityCritical, Warning, or Info.
Cooldown1 minute, 5 minutes, 15 minutes, 1 hour, or 24 hours.
Webhook endpointPick from the configured endpoints. Required.

Delivery guarantees

  • HMAC signing — every request includes a X-Guardway-Signature header computed over the body with the shared secret.
  • Retries — exponential backoff on 5xx and network errors, up to Max Retries.
  • Per-webhook filters — only the events selected on each endpoint are delivered.
  • Audit trail — every delivery attempt (success or failure) is recorded in Audit Log.

How to configure

1

Create a webhook endpoint

Open Settings → Notifications from the dashboard sidebar, scroll to Webhook Endpoints, click Create Webhook. Fill Name, URL, Events, Secret, Timeout, and Max Retries. Save.
2

Verify on your receiver

Trigger one of the selected events (e.g. an MCP call for request.completed) and confirm your endpoint received a signed POST.
3

Create an alert rule

Scroll to Alert Rules, click Create Alert. Set Name, Condition, Threshold, Severity, Cooldown, and pick the Webhook endpoint the alert should notify.
4

Test it

Force the condition (e.g. cross a budget threshold from Playground) and confirm both the gateway log and your endpoint show the delivery.

Verifying the signature

Compute HMAC-SHA256 over the raw request body using your webhook Secret and compare to the X-Guardway-Signature header. Reject the delivery if they don’t match.
  • Audit Log — every webhook delivery attempt is recorded here.
  • Integrations — first-party integrations that don’t need a webhook.