Generic alert webhook

Use the generic alert webhook when your tool has no connector of its own. Send a small JSON body with a status of firing, acknowledged, or resolved, and Squasher opens, acknowledges, or resolves the matching incident.

What you need

A script or tool that can send an HTTPS POST with a custom header.
The Squasher CLI, signed in with write access to the project. See Alert sources.

Connect a sender

Create the connector

squasher alert-connectors create \
  --project "$SQUASHER_PROJECT_ID" \
  --provider generic_webhook \
  --display-name "Infrastructure alerts"

Save setup.endpoint and setup.secret from the output. In the examples below, they are in SQUASHER_ALERT_ENDPOINT and SQUASHER_ALERT_SECRET.

Send a firing alert

curl --fail-with-body "$SQUASHER_ALERT_ENDPOINT" \
  -H "Authorization: Bearer $SQUASHER_ALERT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "alert_id": "database-primary-unavailable",
    "event_id": "evt-2026-09-25-001",
    "status": "firing",
    "title": "Primary database is unavailable",
    "summary": "Health checks failed in us-east-1",
    "severity": "sev-1",
    "occurred_at": "2026-09-25T08:00:00Z",
    "url": "https://status.example.com/alerts/database-primary-unavailable"
  }'

The response is {"action": "opened", ...}.

Resolve the alert

Send the same alert_id with "status": "resolved", a new event_id, and a later occurred_at. The response is {"action": "resolved", ...}.

Fields

Squasher rejects a body with any other field, with 422.

Field	Required	Description
`alert_id`	Yes	Alert key, 1 to 512 characters. Keep it the same from firing to resolved.
`event_id`	Yes	Event key, 1 to 255 characters. Use a new value for each event, and the same value when you retry one event.
`status`	Yes	`firing`, `acknowledged`, or `resolved`.
`title`	Yes	Incident title. Squasher keeps the first 255 characters.
`summary`	No	Incident summary, and the message on the incident timeline.
`severity`	No	A severity key of your project, such as `sev-2`, or a name such as `critical` or `warning`. See Severity. Without it, Squasher uses the connector’s default severity.
`occurred_at`	No	Event time as a string: ISO 8601, or epoch seconds or milliseconds. Without it, Squasher uses the time it received the request.
`url`	No	The alert’s page in your tool, up to 2,048 characters. The incident links back to it. Use an `http` or `https` URL without a user name or password.

An acknowledged event marks an open incident as acknowledged. If no incident is open for the alert_id, Squasher ignores it and does not open one.

Limits

Send the secret only in the Authorization: Bearer header or in the x-squasher-alert-secret header. Never put it in the URL or the body.
Each request carries one alert. For many alerts, send many requests.
Squasher ignores an event whose occurred_at is older than the last event it applied for the same alert_id. A time more than 5 minutes in the future is replaced by the receive time.

Get started

Guides

Generic alert webhook

What you need

Connect a sender

Fields

Limits

Next steps

Alert sources

Route incidents

​What you need

​Connect a sender

​Fields

​Limits

​Next steps

Alert sources

Route incidents

What you need

Connect a sender

Fields

Limits

Next steps