Are webhooks available on the free plan?

Yes. Webhooks, like all thirteen providers, are on every plan including Free, with the same events and the same signed payload as any paid plan.

How do I verify a FishOut webhook signature?

Compute HMAC-SHA256 over {x-fishout-timestamp}.{raw body} using the channel’s signing secret, and compare it in constant time against the v1= value in the x-fishout-signature header. Verify against the raw body before parsing — re-serialising the JSON changes whitespace and key order and the signature will never match.

Can the same event arrive twice?

Yes. A failed delivery is retried, so your handler has to be idempotent — key on the envelope id (the x-fishout-event-id header) rather than assuming exactly-once delivery. This is true of every webhook system and is worth building for on day one.

What happens if my endpoint goes down?

We retry with a growing delay for several attempts, then record the delivery as failed. The notifications screen shows the health state and the failure count for that channel alone, so a broken endpoint never silently stops your other alerts.

Which event should I subscribe to?

mention.scored unless you have a reason not to. mention.created fires before the AI read, so relevance, labels and the Reply call are still null. reply.drafted fires when a reply draft is written. mention.status_changed is listed but not sent yet.

Can I use a webhook instead of the Slack or Discord integration?

Yes, though since chat channels are on every plan there is rarely a reason to. You do the formatting: post the payload to a Slack or Discord incoming webhook yourself. What you give up is the message formatting, burst digests and delivery health being managed for you per channel.

IntegrationsYour own systems

Brand mentions as a signed webhook

The channel with nothing on the other end that we know about — which is the point. Every other provider renders a message from this same envelope, and n8n, Make, Activepieces and Pipedream take it as it is, so if you are building rather than configuring, start here.

Start free Read the alerts docs

On every plan, including Free.

[01] WHAT LANDS THERE/ YOUR ENDPOINT

A mention, as it arrives in Webhooks

Rendered by the code that sends it, from a sample GitHub post. Never the post body.

POST /fishout — mention.scored

{
  "version": 2,
  "id": "mention.scored:wrq_sample:github-sync-drops",
  "type": "mention.scored",
  "organizationId": "org_acme",
  "projectId": "prj_default",
  "occurredAt": "2026-10-19T18:30:00.000Z",
  "simulated": false,
  "data": {
    "resourceType": "mention",
    "resourceId": "mt_github-sync-drops",
    "mention": {
      "id": "mt_github-sync-drops",
      "platform": "github",
      "url": "https://github.com/okafor-dev/helpdesk-bridge/issues/214",
      "title": "Notchmail sync drops threads with more than 50 replies",
      "authorHandle": "okafor-dev",
      "postedAt": "2026-10-19T10:02:00.000Z",
      "relevance": 84,
      "relevanceReason": "relevant",
      "labels": [
        "has-a-problem",
        "complaint"
      ],
      "labelNames": [
        "Has a problem",
        "Complaint"
      ],
      "replyCall": null,
      "replyHint": null,
      "subject": "competitor",
      "sentiment": "negative",
      "status": "new"
    },
    "links": {
      "self": "https://app.fishout.ai/api/v1/orgs/org_acme/projects/prj_default/mentions/mt_github-sync-drops",
      "app": "https://app.fishout.ai/org/org_acme/project/prj_default/inbox?mt_id=mt_github-sync-drops"
    }
  }
}

Version 2 of the envelope: relevance, labels, the Reply call, subject and sentiment, with id as the stable dedupe key. The post body is deliberately absent — fetch links.self with your own API key when you need the text.

[02] CONNECT IT/ SETUP

Point FishOut at your endpoint

4 steps, a few minutes end to end.

1
Add your endpoint
Under Settings → Notifications, add a webhook channel and give it the URL you want the POST to reach. On a paid plan you can also attach one as the webhook action on an agent, when you only want a subset — say, posts labelled Has a problem — rather than everything clearing a floor.
endpoint
```
https://ingest.acmemail.com/fishout
```
2
Subscribe to the events you need
mention.created fires before the AI read, so relevance is still null; mention.scored fires when it is done and carries relevance, labels, the Reply call, subject and sentiment (the event name predates relevance and is kept for compatibility); reply.drafted fires when a reply draft is written. mention.status_changed is listed but not sent yet. Take mention.scored unless you have a reason not to. Webhooks are instant by default rather than batched.
3
Verify the signature
Every request carries an HMAC-SHA256 signature over the timestamp and the raw body. Compute it over {x-fishout-timestamp}.{raw body} with the channel’s signing secret — shown once, when you create or rotate it — compare in constant time against the v1 value, and reject anything older than five minutes so a captured request cannot be replayed.
request headers
```
x-fishout-timestamp: 1757001600
x-fishout-signature: v1=5257a869e7...
```
4
Acknowledge fast, work afterwards
Return a 2xx quickly and do the real work off the request. A slow handler looks identical to a broken one from our side, and the retries will make it worse rather than better.

Then set the floor

This is the one channel where no floor is the right answer. Your systems can filter for themselves, and the whole point of receiving the raw stream is deciding what matters in code rather than in a settings screen. Set a floor here only when you are paying per event somewhere downstream.

Settings · Notifications

Webhooks

https://ingest.acmemail.com/…

Healthy

Relevance floor0

Eventsmention.scored

Batch burstsoff

[03] WHAT IS IN IT/ FIELDS

What Webhooks receives, field by field

Built from the event’s envelope and nothing else, so a retry renders exactly the message the first attempt would have.

Field		How
x-fishout-signature	Shown	v1= HMAC-SHA256 over {timestamp}.{raw body} with the channel’s secret.
x-fishout-event-id	Shown	The envelope id: the key to deduplicate a retried delivery on.
mention.relevance, labels, replyCall	Shown	Null on mention.created, which fires before the AI read.
mention.digest	Never	Only if you opt the channel into batching; instant by default.
links.self	Shown	Fetch it with an API key when you need the text.
Post body	Never	Never sent: the envelope does not carry it.

[04] EVERY EVENT/ INSTANT

One request per event, by default

A machine wants every event and can group them itself, so Webhooks channels send each one as it happens. The same event can arrive twice after a retry: key on the envelope id, which is also the x-fishout-event-id header. Opt into the digest if you would rather receive a mention.digest per window.

Request headers

content-type: application/json
x-fishout-event: mention.scored
x-fishout-event-id: mention.scored:wrq_sample:github-sync-drops
x-fishout-delivery: dlv_…
x-fishout-timestamp: 1760898600
x-fishout-signature: v1=…

[05] WHAT WILL BITE YOU/ LIMITS

What will bite you

These are the constraints of the mechanism itself rather than a vendor’s, and every one of them is documented in full. Failures are tracked per channel, so one broken destination never stops the others.

Verify against the raw request body, before any JSON parsing. Parsing and re-serialising changes whitespace and key order, and the signature will never match. This is the single most common integration bug. [source]

An unverified endpoint is a public write API. Anyone who learns the URL can post whatever they like into your systems, so signature verification is not optional hardening. [source]

Retries mean an event can arrive twice. Make the handler idempotent by keying on the envelope id, which is also in the x-fishout-event-id header — do not assume exactly-once delivery. [source]

A failed delivery is retried with a growing delay for several attempts, then recorded as failed in the channel’s delivery history. It will not quietly keep trying forever, and a signing secret that has gone missing fails the delivery rather than sending it unsigned. [source]

Reject a timestamp more than five minutes old. Without that check a captured request can be replayed against you indefinitely, signature and all. [source]

Delivery is per channel, so a webhook returning 500 marks only that channel failing. It never takes your Slack or email alerts down with it. [source]

In the channel’s delivery history
You see	It means	Do this
destination_not_public	The hostname resolved to a private or loopback address at send time.	Expose the endpoint on a public HTTPS address.
signing_secret_missing	The channel has no signing secret, so nothing is sent unsigned.	Rotate the secret in Settings → Notifications.
timeout	Your handler took too long to answer.	Return a 2xx first and do the work afterwards.
redirect_not_followed	The endpoint answered 3xx; redirects are never followed.	Use the final URL, including the trailing slash if it wants one.