Once webhook notifications have been enabled for your account, navigate to Secure > Alerts. From the company selector dropdown, choose All Companies, then open the Companies tab. A new webhook icon will now appear on the Alerts page. This icon is available for all tenants. Select the webhook icon for the specific tenant where you want alert webhooks to be enabled.

When an alert is triggered, a JSON payload will be sent to your configured destination URL. The structure of the payload varies depending on the alert type; however, the core fields remain consistent. You should design your API to process the key fields outlined below, as these contain the primary alert context and identification data.

{
  "resource": "alert",
  "eventType": "alert_created",
  "organizationId": "1",
  "customerId": "1",
  "integrationContext": {
    "parentTenantId": "parent-tenantid-1111-1111-1111",
    "tenantId": "child-tenantid-1111-1111-1111"
  },
  "alert": {
    "customer": "Example Customer",
    "alert_type": "office365_test_alerttype1",
    "title": "Test alertType",
    "description": "This is a test",
    "severity": "medium",
    "id": "alert_identifier_1",
    "eventDateTime": "2025-11-14T15:21:47.381Z",
    "userStates": [{ "aadUserId": "user-1-guid" }],
    "targetUserStates": [{ "id": "user-2-guid"}],
    "alertType": "office365_test_alerttype1",
    "eventSettings": {},
    "user_name": "Firstuser Lastname1",
    "target_user_name": "Seconduser Lastname2"
  }
}

Each webhook event represents a single alert. The integrationContext identifies the parent and child tenant relationship, while the alert object contains the alert metadata, severity, affected users, and event timestamp. Ensure your endpoint is capable of dynamically handling variations in the alert object based on alert type.

Overview