External Channels

Supported Channels

• Every channel URL must use https://.
• An organization can connect up to 10 channels. Channels that are off count toward the limit.
• Once saved, a URL is never shown in full again — only the start and the last few characters.

Connect a Channel

1. Open Notifications in the console and select the External channels tab. You can also get there from the External channels card in organization settings.
2. Click Connect channel.
3. Paste the channel URL. Slack and Discord URLs select their type automatically. How to get a URL next to the field explains how to create one.
4. Choose the Notifications to send and the options.
5. Click Send test message to make sure messages arrive, then save.

Choose What to Send

Notifications You Can Send

• Log alerts: Sent only to the channels picked on each rule, regardless of channel subscriptions.
• Notifications just for you: Request received and request updates, replies to your feedback.
• Service announcements and External channel turned off notifications.

Only Specific Projects

Message Options

• Message language: Korean or English. It defaults to the organization’s region (English for the US, Korean otherwise) and is stored per channel, so changing the organization’s region later does not change existing channels. Times in messages are shown in KST for Korean and UTC for English.
• Mention @here on failure alerts: Adds @here to failure (red) alerts in Slack and Discord channels. Off by default.
• Include log lines and deployment failure reasons: Includes the matching lines of a log alert and the cause of a deploy failure in the message. On by default. When off, only the title and the console link are sent — turn it off if your logs may contain sensitive values.

What Messages Look Like

• The card color shows severity — failure (red), warning (amber), success (green), info (gray).
• Below the title and text, the matching log lines of a log alert (up to 5) or the cause of a deploy failure appear in a code block.
• Links such as View container, View logs, and View billing take you to the right console page.
• The footer reads AirCloud · {organization name}.

Receiving Webhooks

Request

Body

{
  "id": "6f1c2b0e-2d4a-4a57-9c3e-0b8f0d6a1e42",
  "type": "endpoint.deploy_failed",
  "version": 1,
  "created_at": "2026-11-03T05:12:33.123456+00:00",
  "severity": "error",
  "organization": { "id": "org-xxxxxxxxxxxx", "name": "Acme" },
  "title": "Container 'my-llm' deployment failed",
  "text": null,
  "url": "https://…/console/projects/…/container/…",
  "data": { "endpoint_id": "…", "endpoint_name": "my-llm", "project_id": "…" },
  "detail": "RuntimeError: …"
}

Verify the Signature

• Verify against the raw request bytes. Parsing and re-serializing the JSON breaks the signature.
• Reject requests whose webhook-timestamp is too old (for example, more than 5 minutes) to prevent replay attacks.
• The official libraries for each language verify signatures for you.

import base64
import hashlib
import hmac
import time

TOLERANCE_SECONDS = 5 * 60


def verify(secret: str, headers: dict, body: bytes) -> bool:
    msg_id = headers["webhook-id"]
    timestamp = headers["webhook-timestamp"]
    signature = headers["webhook-signature"]

    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        return False

    key = base64.b64decode(secret.removeprefix("whsec_"))
    signed = f"{msg_id}.{timestamp}.".encode() + body
    expected = base64.b64encode(hmac.new(key, signed, hashlib.sha256).digest()).decode()

    for item in signature.split(" "):
        version, _, value = item.partition(",")
        if version == "v1" and hmac.compare_digest(value, expected):
            return True
    return False

Responses and Retries

• Success: Any 2xx response counts as delivered. Respond within 10 seconds. Redirects are not followed.
• Retries: If a delivery fails or gets no response, it is retried after 30 seconds, 2 minutes, 10 minutes, 30 minutes, 1 hour, and 2 hours (up to 7 attempts including the first, about 4 hours in total). Deliveries older than 6 hours are no longer sent.
• Retry-After: A Retry-After header is honored (up to 30 minutes).
• Deduplication: The same notification can arrive more than once. Deduplicate on webhook-id.

Delivery History and Resending

• Recent deliveries: Shows the latest 50, and history is kept for 30 days. Each is Pending, Sent, Failed, or Skipped.
• Retry: Only failed deliveries can be resent. A resend starts the retry cycle over, with the same webhook-id.
• Test messages are not recorded in the history and never include @here.

When a Channel Is Turned Off Automatically

• When a channel is turned off, the whole organization gets an External channel turned off notification, and the Organization Owner gets an email.
• Pending deliveries at that moment become Skipped. Notifications that occur while a channel is off are not sent later, even after you turn it back on.
• To turn it back on, use the switch in the channel’s details. Changing the URL alone does not turn a channel back on.
• Turning a channel off or deleting it yourself sends no notification.

Regenerate the Signing Secret

Permissions

URL Restrictions

• Only https:// URLs are allowed, and URLs cannot contain a user name or password.
• Internal names such as localhost, .local, and .internal, and private, loopback, and link-local IP addresses are not allowed.
• The address is checked again on every delivery. If it resolves to a private address, the delivery is not sent and the channel is turned off.

Disconnect a Channel

Related Documentation