Webhooks, Microsoft Teams, PagerDuty and Opsgenie

Add channels under Alerts. Every channel carries the same facts as e-mail and Slack alerts: the target name, the status and reason, timings, and the IDs of the checks that did not pass. Never check messages, observed values or anything from your database.

Signed webhook

Verestore sends a POST with a JSON body to a public https:// URL of your choice for each judged run (or only for problems):

{
  "type": "run.judged",
  "id": "whd_01JBX…",
  "created_at": "2026-11-05T02:14:07.000Z",
  "data": {
    "run_id": "run_01JBX…", "org_id": "org_01JBX…",
    "target": { "id": "tgt_01JBX…", "name": "orders-db" },
    "status": "failed", "status_reason": null, "judged_at": "2026-11-05T02:14:07.000Z",
    "restore_seconds": 184.6, "checks_not_passing": ["row_counts"],
    "url": "https://app.verestore.dev/o/org_01JBX…/runs/run_01JBX…"
  }
}

Headers: X-Verestore-Event (run.judged or test), X-Verestore-Delivery (the same on every retry: use it to deduplicate) and X-Verestore-Signature: t=<unix seconds>,v1=<hex>.

The signing secret (whsec_…) is shown once, when you add the channel. To verify a delivery, compute HMAC-SHA256 over <t>.<raw body> with the secret, compare it in constant time with v1, and refuse timestamps more than 5 minutes old:

import { createHmac, timingSafeEqual } from 'node:crypto'

function verify(secret, rawBody, header, now = Date.now()) {
  const m = /^t=(\d+),v1=([0-9a-f]{64})$/.exec(header ?? '')
  if (!m || Math.abs(now / 1000 - Number(m[1])) > 300) return false
  const want = createHmac('sha256', secret).update(`${m[1]}.${rawBody}`).digest()
  return timingSafeEqual(want, Buffer.from(m[2], 'hex'))
}

Answer with any 2xx status within 10 seconds. Redirects are not followed, and the URL must resolve to a public address: this is checked when you add the channel and again on every delivery.

Microsoft Teams

Create a Workflows flow "Post to a channel when a webhook request is received" (or an incoming webhook connector) and paste its URL. Verestore posts an Adaptive Card with the status, timings, the checks that did not pass and an Open run button. Only Microsoft webhook hosts are accepted.

PagerDuty

Add an Events API v2 integration to a service and paste its integration key; choose the EU region if your account is hosted there. A warned, failed or inconclusive run triggers an incident with deduplication key verestore:<target id> (so repeated failures of one target update one incident), and the next passing run of that target resolves it.

Opsgenie

Create an API integration and paste its key; choose the EU region if your account is hosted there. A problem run creates an alert with alias verestore:<target id> (P2 for failed, P3 otherwise); the next passing run of that target closes it.

Retries and the delivery log

Webhook, Teams, PagerDuty and Opsgenie deliveries are retried on network errors, timeouts, 408, 429 and 5xx: after 1 minute, 5 minutes, 15 minutes, 1 hour, 3 hours, 6 hours and 12 hours, for at most 24 hours from the first attempt. Other 4xx answers are final. The Delivery log on the Alerts page shows each delivery's status, HTTP status, number of attempts and next attempt. Send test delivers a test message once, without retries.