Webhooks

Have whoot. call your own systems when something happens — an emergency alert is declared, or a text reply arrives — so another tool can react without anyone re-keying it.

What a webhook does

A webhook is an address of yours that whoot. calls when something happens here. It is how you get an incident into your building management system, a reply into your service desk, or an alert onto a status board, without anybody copying it across by hand.

Choosing events

Each endpoint subscribes to the events it cares about. Two are available today:

• Emergency alert declared (alert.activated) — fires the moment somebody declares an alert in Security Ops, before recipients have finished being contacted. It is a trigger, not a summary of the outcome.
• SMS reply received (sms.inbound) — fires when a recipient replies to one of your numbers, normally within a minute. Near real time, not instant, and not ordered against other events.

What we send

Reply events arrive as JSON:

{
  "event": "sms.inbound",
  "message": {
    "id": "6f1c…",
    "from": "+447700900123",
    "to": "+441234567890",
    "body": "Safe and accounted for at Point B",
    "status": "received",
    "received_at": "2026-09-15T09:04:22Z",
    "campaign_id": "a4d2…"
  }
}

Alert events use a body you control. The editor gives you the alert type, title, whether it is a drill, who activated it and when, and you arrange them however the receiving system expects.

Securing the endpoint

• Destinations must be public https addresses. Private and internal addresses are refused, and re-checked every time we call — so a hostname that later points somewhere internal is still caught.
• Add bearer, basic or API-key credentials and we send them with every request. They are stored encrypted and are never shown again after saving.
• Redirects are not followed. A 3xx counts as a failed delivery.
• We wait ten seconds for a response.

When something breaks

Every attempt is recorded — successful or not — with the response code, how long it took and any error. Open a webhook's row to see its history. Use Send test to check a change before you rely on it.