Webhooks: send alerts to Slack, Discord or your own app

A webhook sends your watchlist alerts to an address outside TrendGap. Paste the incoming-webhook address that Slack or Discord gives you, and the alerts arrive there as chat messages. Any other HTTPS address gets signed JSON (structured data a program can read), which you can pass on with automation tools or handle in your own code. Webhooks are on Pro and above; on other plans the section shows a "Pro" badge and a link to the plans.

Add an endpoint

1. Open Settings and choose the "Webhooks" tab. When you can also connect an AI assistant, the tab is called "Connected apps" and holds the "Webhooks" section.
2. Paste your address into "Endpoint URL".
3. Click "Add endpoint".
4. The "Signing secret" box opens. Click "Copy" and keep the secret somewhere safe: it is shown only once. Then click "Done".
5. Click "Test" on the endpoint. You see "Test delivered" or the reason it failed.

The address must use https on the standard port and be a public web address: local, private and IP addresses are refused, and so are TrendGap's own addresses. The section shows how many endpoints your plan includes and how many you use.

What gets sent

• Alerts: after each check, one message per endpoint with the alerts that passed your rules. The JSON type is "watch.alerts". A very large batch can arrive as several requests.
• The weekly summary: on Monday after the weekly check, one message with the week's alert count, the gap of the week and the new niches, sent only when there is something to say. The JSON type is "digest".
• Tests: what the "Test" button sends. The JSON type is "webhook.test".

At a JSON endpoint, every body has "type", "timestamp" (an ISO date and time) and "data". For alerts, "data" holds "count", "url" and an "alerts" list. Each alert has its "id", "observed_on", "rule", "metric", "comparator", "threshold", "window_days", "value", "previous", "delta", "delta_pct", "new_entries", "released_on", a readable "headline", a "url" into the app, the "watch" (its "id", "kind", "subject", "storefront" and "label") and, for a niche your plan opens, the "niche" ("id", "title" and "slug"). Slack and Discord messages list the first alerts with links, then a link to the rest.

Check the signature

Each request carries three headers in the Standard Webhooks format: "webhook-id", "webhook-timestamp" (Unix seconds) and "webhook-signature". Any Standard Webhooks library can check them with your secret. To check by hand:

1. Read the raw request body exactly as it arrived, before you parse it.
2. Join three parts with dots: the webhook-id, the webhook-timestamp and the body.
3. Take your secret, drop the "whsec_" prefix and base64-decode the rest. That is your key.
4. Compute an HMAC-SHA256 of the joined text with that key, and base64-encode the result.
5. Compare it with the value after "v1," in the webhook-signature header, using a constant-time comparison.
6. Reject a request whose timestamp is far from your server's clock; a few minutes is a common tolerance.

The webhook-id stays the same when a message is sent again, so you can use it to drop duplicates.

Answers, retries and switching off

• Reply with any 2xx status. Redirects are not followed and count as failures, and a receiver that takes too long counts as "timed out". Answer first and do slow work afterwards.
• Failed alert deliveries are retried for about two days, with longer waits between attempts. Weekly summaries and tests are not retried.
• After a number of failed deliveries in a row, the endpoint switches itself off. Check the URL, then switch "Deliver to this endpoint" back on.
• The "Delivery log" lists each delivery with its "Time (UTC)", "Type", "Attempt" and "Result".
• Tests are rate limited: if you send too many, wait a while before the next one.

Manage endpoints

• "Deliver to this endpoint" pauses or resumes deliveries without removing the endpoint.
• "New secret" creates a new signing secret. The old one stops working at once, so update your receiver.
• "Remove" deletes the endpoint and its delivery log.
• If you move to a plan with fewer endpoints, your oldest endpoints keep delivering and the others show "Not delivering". A plan without webhooks delivers to none.