Your website changes state.
We give your tools a hoot.

Set up an endpoint

1. Create a public endpoint that accepts POST with Content-Type: application/json.
2. Open a monitor's edit form and enter its Webhook URL. Use HTTP or HTTPS on port 80 or 443. HTTPS is recommended. Private networks, localhost, URL credentials and fragments are rejected.
3. Enable Also send a webhook when the site recovers if you want recovery events. It is off by default and independent of email and SMS recovery settings.
4. Save the monitor. Confirmed outages will now queue webhooks. Leave the URL blank to disable them.

Return a successful 2xx response directly. Redirects are not followed. The endpoint's DNS addresses are checked for public accessibility on every delivery.

Receive a webhook

Webhooks currently have no cryptographic signature. Event IDs and headers are identifiers, not authentication. Protect your HTTPS endpoint with a long random secret in its URL, such as https://hooks.example.com/uptime?token=YOUR_RANDOM_SECRET, and verify it before accepting a payload. Avoid logging that URL in publicly accessible systems.

This minimal PHP receiver validates the method, secret and event. Set UPTIME_WEBHOOK_TOKEN on your server and replace the processing comment with your application's durable queue or storage operation.

<?php

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    exit;
}

$expected = getenv('UPTIME_WEBHOOK_TOKEN');
$provided = $_GET['token'] ?? '';
if (!$expected || !is_string($provided) || !hash_equals($expected, $provided)) {
    http_response_code(401);
    exit;
}

try {
    $event = json_decode(file_get_contents('php://input'), true, 512, JSON_THROW_ON_ERROR);
} catch (JsonException) {
    http_response_code(400);
    exit;
}

if (!is_array($event) || !is_string($event['id'] ?? null)
    || !in_array($event['event'] ?? null, ['monitor.down', 'monitor.up'], true)) {
    http_response_code(422);
    exit;
}

// Store or enqueue the event durably here before acknowledging it.
// Use event['id'] as a unique key to avoid processing a replay twice.
// Return a 5xx status if you could not persist the event.

http_response_code(204);

For frameworks with CSRF protection, use a dedicated webhook endpoint with its own token check. Keep browser-facing routes protected. Parse JSON as data and never execute content from the request.

Inspect history & replay

Open Webhooks in your dashboard to filter deliveries by monitor or status. Choose Details to inspect the method, URL, request headers and exact JSON body, response status, headers and complete received body, timing and errors. Binary response bodies are displayed as base64.

Logs are retained without an automatic expiry, independently of monitor-check history. They remain available after a downgrade or monitor deletion, and are removed when the account is deleted. URL, header, body and error fields are encrypted at rest. Logging begins when this feature is installed; past responses cannot be recovered.

Choose Replay on a completed attempt and confirm the destination. This creates a new delivery linked to the original, preserving its exact JSON body and URL. The monitor must still exist and use that URL; changing it back is necessary before replaying an older destination. An explicit replay of a recovery event is allowed even when automatic recovery webhooks are now disabled.

Replay requires a paid plan. View plans . Pending attempts cannot be replayed, only one replay of the same attempt can be pending at a time, and each account can request up to 10 replays per minute. Event IDs remain stable, so a receiver that has already processed the event may correctly acknowledge a replay without repeating its work.