Grafana Cloud Webhooks

Observability and alerting platform. Receive events for alert state changes, annotations, and dashboard updates.

Auto Retries & Replay Transforms

Connecting Grafana Cloud to Hookbase

Create a source in Hookbase first — it gives you an ingest URL to paste into Grafana Cloud. Then:

1Go to Grafana → Alerting → Contact points
2Click "Add contact point" and select Webhook
3Paste your Hookbase ingest URL
4Optionally set Authorization credentials for verification
5Assign the contact point to a notification policy

Grafana Cloud webhook docs Grafana Cloud website

Signature verification

Not verified by Hookbase yet

Grafana Cloud signs its webhooks with Bearer token in Authorization, and Hookbase has no verifier for that combination today. We would rather say so here than let a source report every event as verified while nothing was checked.

What you can do:

Receive them on a custom source with no signing secret. Hookbase still dedupes, retries, transforms, routes and replays them; it just does not vouch for the sender.
Set a signing secret anyway if Grafana Cloud can be configured to send a hex HMAC-SHA256 of the raw body in X-Signature, X-Webhook-Signature or X-Hub-Signature-256 — that is the one scheme the custom verifier implements.
Verify downstream: the original headers travel with the event, so your own service or a transform can check the signature itself. The key is at Grafana → Alerting → Contact points → Webhook → Authorization Header (Credentials).
Narrow the blast radius with an IP allowlist and a hard-to-guess source slug.

Grafana Cloud event types

4 of the events people route most often. Hookbase accepts every event Grafana Cloud sends, whether or not it is listed here.

alerting

An alert transitioned to alerting state

An alert returned to OK state

pending

An alert is pending evaluation

no_data

An alert received no data

What a Grafana Cloud webhook looks like

A alerting payload. Hookbase stores the raw body exactly as it arrived, so this is also what you get back on a replay.

{
  "receiver": "hookbase",
  "status": "firing",
  "alerts": [
    {
      "status": "firing",
      "labels": {
        "alertname": "HighErrorRate",
        "severity": "critical",
        "service": "api"
      },
      "annotations": {
        "summary": "Error rate above 5%",
        "description": "API error rate is 7.2% for the last 5 minutes"
      },
      "startsAt": "2024-01-15T10:30:00Z",
      "endsAt": "0001-01-01T00:00:00Z",
      "generatorURL": "https://grafana.example.com/alerting/grafana/abc123/view",
      "fingerprint": "abc123def456",
      "values": {
        "A": 7.2
      }
    }
  ],
  "groupLabels": {
    "alertname": "HighErrorRate"
  },
  "commonLabels": {
    "alertname": "HighErrorRate",
    "severity": "critical"
  },
  "externalURL": "https://grafana.example.com/",
  "version": "1",
  "groupKey": "abc123",
  "truncatedAlerts": 0,
  "title": "[FIRING:1] HighErrorRate critical api",
  "message": "Error rate above 5%"
}

Start receiving Grafana Cloud webhooks

Create a source, paste the URL into Grafana Cloud, and watch the first event arrive. The free tier includes 1,000 events a month.

Get Started Free

Connecting Grafana Cloud to Hookbase

Create a source in Hookbase first — it gives you an ingest URL to paste into Grafana Cloud. Then:

1Go to Grafana → Alerting → Contact points

2Click "Add contact point" and select Webhook

3Paste your Hookbase ingest URL

4Optionally set Authorization credentials for verification

5Assign the contact point to a notification policy

Signature verification

Not verified by Hookbase yet

What you can do:

Receive them on a custom source with no signing secret. Hookbase still dedupes, retries, transforms, routes and replays them; it just does not vouch for the sender.
Set a signing secret anyway if Grafana Cloud can be configured to send a hex HMAC-SHA256 of the raw body in X-Signature, X-Webhook-Signature or X-Hub-Signature-256 — that is the one scheme the custom verifier implements.
Verify downstream: the original headers travel with the event, so your own service or a transform can check the signature itself. The key is at Grafana → Alerting → Contact points → Webhook → Authorization Header (Credentials).
Narrow the blast radius with an IP allowlist and a hard-to-guess source slug.

What a Grafana Cloud webhook looks like

A alerting payload. Hookbase stores the raw body exactly as it arrived, so this is also what you get back on a replay.

{ "receiver": "hookbase", "status": "firing", "alerts": [ { "status": "firing", "labels": { "alertname": "HighErrorRate", "severity": "critical", "service": "api" }, "annotations": { "summary": "Error rate above 5%", "description": "API error rate is 7.2% for the last 5 minutes" }, "startsAt": "2024-01-15T10:30:00Z", "endsAt": "0001-01-01T00:00:00Z", "generatorURL": "https://grafana.example.com/alerting/grafana/abc123/view", "fingerprint": "abc123def456", "values": { "A": 7.2 } } ], "groupLabels": { "alertname": "HighErrorRate" }, "commonLabels": { "alertname": "HighErrorRate", "severity": "critical" }, "externalURL": "https://grafana.example.com/", "version": "1", "groupKey": "abc123", "truncatedAlerts": 0, "title": "[FIRING:1] HighErrorRate critical api", "message": "Error rate above 5%" }