Webhook alerts

A webhook channel on a certificate alert sends an HTTP POST request to your endpoint whenever the alert fires. Use a webhook to connect certificate alerts to your own systems or to services Infisical doesn’t support directly.

Add a webhook channel to an alert

Create an alert in your application, or edit an existing one.

Select Add Channel > Webhook and enter the URL of your endpoint. The URL must use HTTPS.

Optionally, enter a Signing Secret so your endpoint can verify the signature of each request.

Optionally, select Send test to send a test notification to the channel.

Select Continue, check the Review step, and select Create Alert.

Webhook event types

Each request is a CloudEvents JSON payload. The type and subject fields name the event:

Event	`type`	`subject`
Expiration	`com.infisical.cert-manager.application.certificate.expiry`	`cert-manager.application.certificate.expiry`
Issuance	`com.infisical.cert-manager.application.certificate.issuance`	`cert-manager.application.certificate.issuance`
Renewal	`com.infisical.cert-manager.application.certificate.renewal`	`cert-manager.application.certificate.renewal`
Revocation	`com.infisical.cert-manager.application.certificate.revocation`	`cert-manager.application.certificate.revocation`

Webhook payload format

data.items lists the certificates the alert fired for. Each item has the certificate’s ID, a title (its common name, or its first SAN or serial number when it has none), a one-line summary, a severity, and a list of display fields. To act on a certificate in code, read resource instead of fields: it holds the certificate’s typed values, with ISO 8601 dates and the raw revocation reason code. An expiration request can include several certificates, and data.alert.condition holds the alert’s lead time as you entered it, such as 30d or 2w. Issuance, renewal, and revocation requests include the one certificate the event was about.

Only alerts created in an application send this payload. Alerts created before certificate alerts moved to applications keep sending the older com.infisical.pki.certificate.* event types with a data.certificates list. If one endpoint receives both, check the type field to tell them apart.

Expiration
Revocation

{
  "specversion": "1.0",
  "type": "com.infisical.cert-manager.application.certificate.expiry",
  "source": "/applications/<application-id>/alerts/<alert-id>",
  "id": "<unique-event-id>",
  "time": "2026-09-24T00:00:09.664Z",
  "datacontenttype": "application/json",
  "subject": "cert-manager.application.certificate.expiry",
  "data": {
    "alert": {
      "id": "<alert-id>",
      "name": "tls-expiry-alert",
      "resourceType": "cert-manager.application",
      "resourceId": "<application-id>",
      "condition": "30d"
    },
    "items": [
      {
        "id": "<certificate-id>",
        "title": "api.example.com",
        "summary": "Certificate 'api.example.com' in application 'payments-api' expires on October 4, 2026 at 11:59 PM UTC",
        "severity": "error",
        "fields": [
          { "label": "Serial Number", "value": "105d3b4c28132774ab17e350c0e8229ba1bef40d" },
          { "label": "SANs", "value": "api.example.com, www.api.example.com" },
          { "label": "Profile", "value": "tls-server" },
          { "label": "Expires", "value": "October 4, 2026 at 11:59 PM UTC" }
        ],
        "resource": {
          "id": "<certificate-id>",
          "serialNumber": "105d3b4c28132774ab17e350c0e8229ba1bef40d",
          "commonName": "api.example.com",
          "altNames": ["api.example.com", "www.api.example.com"],
          "status": "active",
          "notBefore": "2026-07-06T23:59:00.000Z",
          "notAfter": "2026-10-04T23:59:00.000Z",
          "revokedAt": null,
          "revocationReason": null,
          "profileId": "<profile-id>",
          "profileName": "tls-server",
          "applicationId": "<application-id>",
          "applicationName": "payments-api"
        }
      }
    ],
    "metadata": {
      "totalItems": 1,
      "viewUrl": "https://app.infisical.com/organizations/<org-id>/projects/cert-manager/<project-id>/applications/<application-name>"
    }
  }
}

Revocation items also include a Revocation Reason field. Issuance and renewal requests have the same shape without that field.

{
  "specversion": "1.0",
  "type": "com.infisical.cert-manager.application.certificate.revocation",
  "source": "/applications/<application-id>/alerts/<alert-id>",
  "id": "<unique-event-id>",
  "time": "2026-09-24T14:22:00.000Z",
  "datacontenttype": "application/json",
  "subject": "cert-manager.application.certificate.revocation",
  "data": {
    "alert": {
      "id": "<alert-id>",
      "name": "prod-revocation-notify",
      "resourceType": "cert-manager.application",
      "resourceId": "<application-id>"
    },
    "items": [
      {
        "id": "<certificate-id>",
        "title": "api.example.com",
        "summary": "Certificate 'api.example.com' was revoked in application 'payments-api'",
        "severity": "warning",
        "fields": [
          { "label": "Serial Number", "value": "105d3b4c28132774ab17e350c0e8229ba1bef40d" },
          { "label": "Profile", "value": "tls-server" },
          { "label": "Expires", "value": "October 4, 2026 at 11:59 PM UTC" },
          { "label": "Revocation Reason", "value": "Key Compromise" }
        ],
        "resource": {
          "id": "<certificate-id>",
          "serialNumber": "105d3b4c28132774ab17e350c0e8229ba1bef40d",
          "commonName": "api.example.com",
          "altNames": [],
          "status": "revoked",
          "notBefore": "2026-07-06T23:59:00.000Z",
          "notAfter": "2026-10-04T23:59:00.000Z",
          "revokedAt": "2026-09-24T14:21:58.000Z",
          "revocationReason": 1,
          "profileId": "<profile-id>",
          "profileName": "tls-server",
          "applicationId": "<application-id>",
          "applicationName": "payments-api"
        }
      }
    ],
    "metadata": {
      "totalItems": 1,
      "viewUrl": "https://app.infisical.com/organizations/<org-id>/projects/cert-manager/<project-id>/applications/<application-name>"
    }
  }
}

Webhook signature verification

If you set a signing secret, each request carries an x-infisical-signature header:

x-infisical-signature: t=<timestamp>,v1=<signature>

Component	Description
`t=<timestamp>`	Unix timestamp in milliseconds when Infisical signed the request
`v1=<signature>`	Hex-encoded HMAC SHA256 signature

Verify the signature

Read the timestamp and the signature from the header
Join the timestamp and the raw request body with a dot: {timestamp}.{raw-body}
Compute the HMAC SHA256 of that string with your signing secret
Compare the result with the signature from the header

const crypto = require('crypto');

function verifyWebhookSignature(header, body, secret) {
  const parts = header.split(',');
  const timestamp = parts[0].replace('t=', '');
  const signature = parts[1].replace('v1=', '');

  const signaturePayload = `${timestamp}.${body}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signaturePayload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

What’s next?

Slack

Send alerts to a Slack channel.

PagerDuty

Create incidents in PagerDuty.

Certificate syncs

Push certificates to cloud destinations.

Certificates

View and manage certificates.

Certificate management

Product reference

Reference

Add a webhook channel to an alert

Webhook event types

Webhook payload format

Webhook signature verification

Verify the signature

What’s next?

Slack

PagerDuty

Certificate syncs

Certificates

​Add a webhook channel to an alert

​Webhook event types

​Webhook payload format

​Webhook signature verification

​Verify the signature

​What’s next?

Slack

PagerDuty

Certificate syncs

Certificates

Add a webhook channel to an alert

Webhook event types

Webhook payload format

Webhook signature verification

Verify the signature

What’s next?