Webhook Integration

• Name (required): The name of the webhook
• URL (required): The URL of the webhook. You can use template variables in the URL for dynamic values (see template variables section below)
• HTTP Method: The HTTP method to use when sending the webhook. Default is POST
• Headers: Additional headers to send with the webhook. If you are sending a POST request, Content-Type header is added by default with the value application/json. You can add more headers by clicking on the Add Header button.
• Body Template (optional): If you would like to send a custom body with the webhook, you can use the body template. Leave empty to use the default JSON payload. You can use template variables in your webhook body (see template variables section below).
• Folder Location: The filesystem folder where the webhook is saved. Manual webhooks default to /webhooks/default/, and custom team folders must live under /webhooks/.

​

Kubernetes-managed webhooks

apiVersion: observability.metoro.io/v1alpha1
kind: MetoroWebhook
metadata:
  name: rootly-critical-alerts
  namespace: metoro-hub
spec:
  displayName: Rootly Critical Alerts
  url: https://api.example.com/webhook?alert=$alert_name
  method: POST
  headers:
    Content-Type: application/json
  body: |
    {
      "alert": "$alert_name",
      "state": "$alert_state",
      "message": "$alert_message"
    }

webhookDestination:
  uuid: kubernetes-managed.prod-cluster.metoro-hub.rootly-critical-alerts
  name: Rootly Critical Alerts

​

Exporting an existing webhook as a MetoroWebhook resource

• metadata.name is derived from the webhook’s display name (lowercased and sanitized to a valid Kubernetes name, falling back to webhook-<uuid> if the name contains no usable characters). For webhooks that are already Kubernetes-managed, the original resource name is preserved.
• No namespace is included — choose it when applying: kubectl apply -n <namespace> -f my-webhook.yaml.
• Applying the manifest creates a new Kubernetes-managed webhook with ID kubernetes-managed.<cluster>.<namespace>.<name> — it does not take over the original webhook. Update any alerts that reference the original webhook to point at the new one, then delete the original from the UI to avoid duplicate notifications.

​

Template Variables

​

Alert variables

• $alert_name: The name of the alert
• $alert_description: The description of the alert
• $alert_uuid: The UUID of the alert definition
• $alert_fire_uuid: The UUID of the specific alert fire instance
• $alert_state: The state of the alert (either “firing” or “resolved”)
• $deep_link: Direct link to view the alert details in Metoro
• $environment: [Deprecated - use $attributes instead] Environment context of the alert. It’s set for Kubernetes and Log alerts only or if the alert has a group by with environment
• $service: [Deprecated - use $attributes instead] The service associated with the alert. It’s set for Kubernetes and Log alerts only or if the alert has a group by with service.name/service_name/client.service.name/server.service.name.
• $fired_at: Unix Timestamp when alert was fired
• $resolved_at: Unix Timestamp when alert was resolved/recovered.
• $breaching_datapoint_value: The last metric/trace value that triggered the alert. It’s set for Trace and Metric alerts only.
• $breaching_datapoint_time: Unix Timestamp of the last breaching value. It’s set for Trace and Metric alerts only.
• $metric_name: Name of the metric that triggered the alert. It’s set for Trace and Metric alerts only.
• $attributes: List of attribute key and value pairs (in key: value format) for which the alert is firing. Only set when you use a group by in your alert.

​

AI SRE (Guardian) notification variables

• $title: The notification title, as plain text
• $message: The notification message, as plain text
• $type: The specific event type (see the table below) — use this to distinguish notifications on your end
• $deep_link: Direct link to view the relevant page in Metoro (may be empty for some notification types where the link is embedded in the message instead)

​

Default Guardian webhook payload

{
  "id": "8f2c1d34-2d9a-4b4a-bb0e-6a0d7c1f5e55",
  "type": "anomalyDetected",
  "timestamp": "2026-07-29T10:12:03Z",
  "title": "5XX rate anomaly detected for `checkout-service` in `prod-eu` ...",
  "message": "5XX rate anomaly detected for `checkout-service` in `prod-eu` ...",
  "data": {
    "deepLink": "https://us-east.metoro.io/events/inbox",
    "serviceName": "checkout-service",
    "environment": "prod-eu",
    "namespace": "shop",
    "anomalyType": "5xx_rate_increase",
    "zScore": 4.12,
    "currentValue": 8.4,
    "baselineValue": 1.1
  }
}

• id is the UUID of the underlying event — stable across delivery retries, use it for deduplication.
• type determines the shape of the typed data object; the full schema for every event type is in the Webhook Events section of the API reference (starting at deployment rollout detected).

​

Examples

​

URL Examples

https://api.example.com/webhook?alert=$alert_name&value=$breaching_datapoint_value
https://api.example.com/alerts/$alert_uuid/fire/$alert_fire_uuid
https://api.example.com/webhook?state=$alert_state&service=$service

​

Body Template Examples

1. JSON format:

{ 
  "alert": "$alert_name", 
  "alert_uuid": "$alert_uuid",
  "alert_fire_uuid": "$alert_fire_uuid",
  "state": "$alert_state",
  "value": "$breaching_datapoint_value",
  "deep_link": "$deep_link" 
}

2. Plain text format:

Alert $alert_name ($alert_uuid) is $alert_state with value $breaching_datapoint_value

3. XML format:

<alert>
  <name>$alert_name</name>
  <uuid>$alert_uuid</uuid>
  <fire_uuid>$alert_fire_uuid</fire_uuid>
  <state>$alert_state</state>
  <value>$breaching_datapoint_value</value>
</alert>