Receive Simrix Monitor alerts on your own webhook

Steps

1. Open Account → Webhooks and choose Add webhook.
2. Give it a name you will recognise later, and paste the URL that should receive the POST.
3. Tick the events you want: Change detected, Monitor failed, Monitor recovered. All three are on by default.
4. Save. The signing secret is shown once, on this screen only. Copy it somewhere safe before you navigate away, because there is no way to reveal or rotate it afterwards.
5. Verify the signature on every request you receive, using the snippet below.
6. Wait for a scheduled check to fire. Running a check by hand will not send anything.

How do you test it before a real failure?

There is no send-test button, and no test endpoint. That is worth knowing before you plan a rollout.

The practical approach is to point a webhook at a request-capture service such as webhook.site while you are building, confirm the shape and your signature check against a real delivery, then switch the URL to your own endpoint. Because only scheduled checks fire webhooks, you will need to wait for one, or temporarily set a monitor to the shortest interval your plan allows and point it at a URL you can break on purpose.

What can you change after creating one?

Less than you might expect. From the Webhooks page you can pause an endpoint and delete it, and that is all. There is no interface for changing the URL, the name or the selected events once an endpoint exists, and no way to reveal or rotate the signing secret.

If you need to change any of those, delete the endpoint and create a new one, which issues a fresh secret.

What does Simrix Monitor send?

A single JSON POST per event. Here is a real body for a failed check.

{
  "event": "monitor_failed",
  "timestamp": "2026-09-14T14:03:11.482Z",
  "workspaceId": "clz9a1b2c3d4e5f6g7h8i9j0",
  "monitor": {
    "id": "clz8m0n1o2p3q4r5s6t7u8v9",
    "name": "Checkout smoke test",
    "type": "page_check",
    "url": "https://shop.example.com/checkout"
  },
  "run": {
    "id": "clz7r0u1n2i3d4e5f6g7h8i9",
    "status": "failed",
    "changeDetected": false,
    "aiSummary": "We could not find “#place-order” on the page at step 3 of 6. It may have been renamed or moved, or the page may not have got that far.",
    "failureSummary": "We could not find “#place-order” on the page at step 3 of 6. It may have been renamed or moved, or the page may not have got that far.",
    "failureReasonCode": "element_not_found",
    "durationMs": 31204,
    "httpStatus": 200,
    "screenshotUrl": "/api/artifacts/clz7r0u1n2i3d4e5f6g7h8i9/screenshot.png",
    "diffScreenshotUrl": null,
    "shareUrl": "https://simrixmonitor.com/r/Zq8nT2xK9pLm4vR7wYbC1dF3hJ5kN6sQ8tU0xW2yA4E"
  }
}

Which events can fire?

What is in the body?

Which headers arrive?

How do you verify the signature?

The signature is an HMAC-SHA256 of the raw request body, keyed with your signing secret and written as lowercase hex behind a sha256= prefix.

import crypto from "node:crypto";

// Sign the RAW body. Re-serialising parsed JSON will not match.
function isFromSimrixMonitor(rawBody, header, secret) {
  const expected =
    "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(header ?? "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

What should your receiver expect?

• Delivery is attempted once. A non-2xx response, a connection error or a timeout is logged and dropped. There is no retry, no backoff and no dead-letter queue, so treat a missed delivery as possible and reconcile from the app when it matters.
• The timeout is 10 seconds for the whole request. Acknowledge quickly and do your own work afterwards, rather than processing before you respond.
• The signature covers the raw body only. No timestamp is included, so there is no replay protection built in. If that matters, record run.id and ignore ids you have already handled.
• Change monitors only fire change_detected. A change monitor that errors does not send monitor_failed, and change monitors never send monitor_recovered. Subscribing to monitor_failed will not tell you a change monitor is broken.
• Failure and recovery webhooks follow the email toggles. Turning off Failure alerts or Recovery alerts on the notifications page turns off the matching webhook as well.
• Only scheduled checks send anything. Running a check by hand to try something out fires no webhook and sends no email.