Webhook adapters
Webhook adapters
Webhook adapters translate external provider payloads into the canonical WarnFire event model. Adapters reuse the normal authorized ingest path, so validation, deduplication, rate limits, incident updates, and escalation behavior remain consistent.
Available adapters
| Adapter | Delivery model | Purpose |
|---|---|---|
| Generic | One delivery, one event | Accept a provider-neutral envelope without custom backend code. |
| Alertmanager | One delivery, one alert group event | Correlate a Prometheus Alertmanager group into one WarnFire incident. |
The console provides a mapping preview that does not ingest an event and a confirmed Send test action that follows the real ingest and paging path.
Security rule
Authenticate webhook requests using a header or request body supported by the integration. Keys must not be placed in URLs. Some providers, including basic Splunk webhook actions, cannot set custom headers; those integrations require a reviewed provider app or another credential transport rather than silently weakening the generic endpoint.
Alertmanager
Configure send_resolved: true so resolved alert groups close their correlated WarnFire incident. The adapter uses the Alertmanager groupKey for correlation and a deterministic mapped-payload hash for idempotency. Changed visible values create an update; an identical retry does not.
For current request shapes and rejection rules, see the repository adapter guide and the OpenAPI document.