> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squasher.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Generic alert webhook

> Raise and resolve Squasher incidents from any alerting system over HTTPS.

Use the generic alert webhook when a monitoring system can send JSON but does
not have a native Squasher connector yet.

## Create the connector

```bash theme={null}
squasher alert-connectors create \
  --project "$SQUASHER_PROJECT_ID" \
  --provider generic-webhook \
  --display-name "Infrastructure alerts"
```

Save the returned `setup.endpoint` and `setup.secret`. The secret is shown
only when the connector is created or rotated.

## Send an alert

```bash theme={null}
curl --fail-with-body \
  -H "Authorization: Bearer <setup.secret>" \
  -H "Content-Type: application/json" \
  -d '{
    "alert_id": "database-primary-unavailable",
    "event_id": "evt-2026-08-05-001",
    "status": "firing",
    "title": "Primary database is unavailable",
    "summary": "Health checks failed in us-east-1",
    "severity": "sev-1",
    "occurred_at": "2026-08-05T08:00:00.000Z"
  }' \
  "<setup.endpoint>"
```

Resolve the same incident by reusing `alert_id`, changing `status` to
`resolved`, and sending a new `event_id` and `occurred_at`.

To acknowledge an open incident, reuse `alert_id`, set `status` to
`acknowledged`, and send a new `event_id`. Squasher records the acknowledgement
on that incident without resolving it. An acknowledgement received before any
firing event is accepted as `ignored` and does not manufacture an incident.

`alert_id` is the stable correlation key. `event_id` makes retries
idempotent, while `occurred_at` prevents an older delivery from overwriting a
newer state. Requests without `occurred_at` use the Squasher receive time.

`severity` may be any valid severity key configured for the project. It is not
limited to `sev-1` through `sev-7`; additional ranks and legacy project keys remain
valid. When omitted, the connector's `default_severity` is used.

Send the bearer secret only in the `Authorization` header. Do not include it in
the URL or payload. Rotation keeps the previous secret valid for 24 hours, so update
the sender during the overlap and send a firing/resolved test pair after every rotation.

The resulting incidents use the same Slack, webhook, email, and PagerDuty
routes as native Squasher monitors.

Related: [Inbound alert connectors](/integrations/alert-connectors),
[Alert Connectors API](/api-reference/alert-connectors),
[Notifications](/features/alerts).