Webhook payload format

Beacon delivers incident events as JSON POSTs with an HMAC signature.

{
  "event": "incident.opened",
  "incident": {
    "id": "inc_8f2c1a",
    "status": "open",
    "severity": "major",
    "components": ["api", "webhooks"],
    "opened_at": "2026-07-11T09:14:22Z"
  },
  "monitor": {
    "id": "mon_c41d99",
    "name": "API /healthz",
    "region": "eu-west"
  }
}

Events: incident.opened, incident.acknowledged, incident.resolved, maintenance.started, maintenance.completed.

Verification. Every request carries X-Beacon-Signature: sha256=<hmac> computed over the raw body with your endpoint's signing secret. Reject anything unsigned.

Retries. Non-2xx responses are retried with exponential backoff for up to 6 hours. Deliveries are at-least-once — dedupe on incident.id + event.