Skip to main content

​
What this is for

Settings → Notifications lets you push gateway events to any HTTPS endpoint and create alert rules that fire into those endpoints when conditions cross a threshold. Use it to feed SIEM tools, page on-call, drop budget warnings into Slack, or replicate audit events into your own pipeline. The page has two sections: Alert Rules (conditions that trigger notifications) and Webhook Endpoints (where the notifications go).

​
Options

​
Webhook Endpoints

Create Webhook form:

​
Available events

Events are grouped by category. Common ones:

​
Alert Rules

Create Alert form:

​
Delivery guarantees

  • HMAC signing — every request includes a X-Guardway-Signature header computed over the body with the shared secret.
  • Retries — exponential backoff on 5xx and network errors, up to Max Retries.
  • Per-webhook filters — only the events selected on each endpoint are delivered.
  • Audit trail — every delivery attempt (success or failure) is recorded in Audit Log.

​
How to configure

1

Create a webhook endpoint

Open Settings → Notifications from the dashboard sidebar, scroll to Webhook Endpoints, click Create Webhook. Fill Name, URL, Events, Secret, Timeout, and Max Retries. Save.
2

Verify on your receiver

Trigger one of the selected events (e.g. an MCP call for request.completed) and confirm your endpoint received a signed POST.
3

Create an alert rule

Scroll to Alert Rules, click Create Alert. Set Name, Condition, Threshold, Severity, Cooldown, and pick the Webhook endpoint the alert should notify.
4

Test it

Force the condition (e.g. cross a budget threshold from Playground) and confirm both the gateway log and your endpoint show the delivery.

​
Verifying the signature

Compute HMAC-SHA256 over the raw request body using your webhook Secret and compare to the X-Guardway-Signature header. Reject the delivery if they don’t match.
  • Audit Log — every webhook delivery attempt is recorded here.
  • Integrations — first-party integrations that don’t need a webhook.