Outbound webhooks

Plan availability

Webhooks is available on Pro and Business. See the plan comparison.

Outbound webhooks let DomainDash push events to your own systems the moment something happens — so you can wire DomainDash into Zapier, Make, n8n, or your own infrastructure, and let your tools react before you've even read the alert.

What outbound webhooks are

A webhook is an HTTP request DomainDash sends to a URL you choose whenever an event you care about happens. You don't have to poll DomainDash for changes — DomainDash tells you. The moment a site goes down, comes back, or a certificate is about to expire, DomainDash sends a signed POST request to your endpoint with the details.

Each event arrives as a JSON payload with a type (like site.went_down), a timestamp, and a data object describing what happened.

Adding an endpoint

You manage webhooks under Settings → Developers → Webhooks. To add one, choose Add endpoint and fill in:

• URL — the HTTPS address DomainDash should send events to. It must be an HTTPS URL.
• Description — an optional label to remind you what the endpoint is for, for example "Zapier integration".
• Events — the events you want this endpoint to receive (see below).

You can add more than one endpoint and subscribe each to a different set of events — for example, one endpoint for incident events and another for expiry warnings. Each system hears only about the events it cares about.

Choosing which events to subscribe to

Each endpoint only receives the events you subscribe it to. The available events, grouped by category:

Sites

• Site added — a new site was added to the team.

Incidents

• Site went down — a site became unreachable.
• Site recovered — a site came back online after being unreachable.

SSL

• SSL certificate expiring — a site's SSL certificate is approaching expiry.
• SSL certificate expired — a site's SSL certificate has expired.
• SSL certificate renewed — a site's SSL certificate was renewed.

Domain

• Domain expiring — a site's domain registration is approaching expiry.
• Domain expired — a site's domain registration has expired.
• Domain renewed — a site's domain registration was renewed.

DNS

• DNS resolution failing — a site's DNS resolution started failing.
• DNS resolution restored — a site's DNS resolution was restored.

You can change which events an endpoint is subscribed to at any time by editing it.

The signing secret

When you create an endpoint, DomainDash generates a unique signing secret that starts with whsec_. You'll see it once, in a banner at the top of the page, right after you save the endpoint.

Copy your signing secret straight away

The signing secret is shown only once, when you create the endpoint or rotate the secret. DomainDash stores it encrypted and can't show it to you again afterwards. Copy it into your secrets manager before you leave the page.

You use the signing secret to verify that an incoming request genuinely came from DomainDash and wasn't tampered with on the way.

Rotating the secret

If you ever need to replace the secret — for example if it might have leaked — use Rotate secret in the endpoint's menu. DomainDash generates a new whsec_ secret and shows it once. Your old secret stops working immediately, so update your endpoint to use the new one straight away.

Verifying the signature

DomainDash signs every delivery using the Standard Webhooks scheme. Each request includes three headers:

• webhook-id — a unique ID for the event.
• webhook-timestamp — when the event was sent.
• webhook-signature — the signature, computed from your signing secret.

Your endpoint should verify the signature before trusting the payload. Because Standard Webhooks is an open standard, you can use any Standard Webhooks library in your language of choice — pass it your whsec_ signing secret and the three headers, and it confirms the request is authentic. That's your assurance every event is genuinely from DomainDash, and that nobody else can slip a fake one in.

Sending a test event

To check your endpoint is wired up correctly, use Send test event from the endpoint's menu. DomainDash queues a webhook.test event and sends it to your URL, signed exactly like a real event. Watch it land in recent deliveries and confirm your endpoint accepted it — so you know it'll work when a real incident fires, not just hope it does.

Who can manage webhooks

Webhooks are managed by the team owner and admins. Members can't add, edit, or delete endpoints. Managing webhooks also requires a plan that includes the feature — if your plan doesn't, you'll see an upgrade prompt rather than the management screen.

Frequently asked questions

Can I send different events to different endpoints?

Yes. You can add more than one endpoint and subscribe each to a different set of events — for example, one endpoint for incident events and another for expiry warnings. Each system hears only about the events it cares about, and you can change which events an endpoint receives at any time by editing it.

What happens if I lose my signing secret?

The signing secret is shown only once, when you create the endpoint or rotate the secret, and DomainDash stores it encrypted and can't show it to you again. If you lose it or it might have leaked, use Rotate secret in the endpoint's menu — DomainDash generates a new whsec_ secret and shows it once. Your old secret stops working immediately, so update your endpoint straight away.

How do I verify a webhook came from DomainDash?

DomainDash signs every delivery using the Standard Webhooks scheme, with webhook-id, webhook-timestamp, and webhook-signature headers. Use any Standard Webhooks library in your language, pass it your whsec_ signing secret and the three headers, and it confirms the request is authentic before you trust the payload.

Who can manage webhooks?

Webhooks are managed by the team owner and admins — members can't add, edit, or delete endpoints. Managing webhooks also requires a plan that includes the feature; if your plan doesn't, you'll see an upgrade prompt rather than the management screen.

Related

• Deliveries and retries for what happens after an event is sent
• How incidents work for the events that trigger webhooks
• Notification channels for the other ways DomainDash can alert you
• Plans and pricing for which plans include webhooks