Integration

Webhooks for Domain Alerts

Webhooks are the most direct integration Notify.domains offers. You set one HTTPS URL in your profile; we send a JSON POST to it for every change on your watched domains. Optionally generate a signing secret and every payload arrives with an HMAC header you can verify. Wire it into any system you run.

Setup

  1. 1

    Create a URL that accepts POST

    Any HTTPS endpoint works: a Cloud Function, an Express route, a Lambda, a Rails controller. It needs to accept POST with Content-Type: application/json; charset=utf-8 and return a 2xx on success.

  2. 2

    Paste the URL into your profile

    Open your Profile, scroll to Notifications, paste the URL into Custom webhook URL, and save. The URL applies to every domain you watch; use the per-domain toggle in the dashboard to turn it off for individual domains.

  3. 3

    Generate a signing secret and verify

    Click Generate signing secret. The secret is shown once; copy it somewhere safe. From that point on, every payload includes an X-Notify-Domains-Signature header of the form sha256=<hex>. Compute HMAC-SHA256(body, secret) on your side and compare.

Example payload

This is exactly what the webhook body looks like. Use it to build your downstream logic.

POST /your-webhook HTTP/1.1
Content-Type: application/json; charset=utf-8
X-Notify-Domains-Signature: sha256=9f2ae1b8c4d6...

{
  "event": "domain.alert",
  "version": 1,
  "occurred_at": "2026-04-19T18:30:00Z",
  "domain": "example.com",
  "tier": "act_now",
  "summary": "example.com is in pending delete. Drop expected in 5 days.",
  "dashboard_url": "https://notify.domains/dashboard/domain/example.com",
  "lines": [
    { "label": "Registrar",   "value": "GoDaddy" },
    { "label": "Drop window", "value": "Apr 24, 2026 7:00pm UTC" }
  ],
  "subscriber_user_id": 4217
}

What you get

Optional HMAC signing

Generate a signing secret any time; every payload posts with an X-Notify-Domains-Signature: sha256=... header. Leave the secret blank if you only need plain JSON.

Per-domain on/off

The webhook fires for every watched domain by default. Turn it off on individual domains from the dashboard to keep the webhook focused on the ones that matter.

One consistent payload

Every event uses the same schema: event, tier, domain, summary, dashboard_url, and an array of detail lines. You write one handler, not one per event type.

Rotate the secret anytime

Regenerate the signing secret from your profile to instantly invalidate the old one. The new value is shown once so you can update your handler.

Frequently asked questions

How do I verify a webhook is from Notify.domains?

Set a signing secret in your profile. Every request then includes an X-Notify-Domains-Signature header of the form sha256=<hex>. Compute HMAC-SHA256 of the raw request body using your secret, hex-encode it, and compare. If it does not match, reject the request.

How many webhook URLs can I connect?

One per account. If you need to fan out to multiple systems, point the webhook at a tool that does the fanout (Zapier, n8n, a small Lambda) and let that dispatch to the downstream services.

What if my endpoint is temporarily down?

The POST returns non-2xx and the delivery is skipped for that event. We do not yet queue and retry failed webhook deliveries, so an endpoint that goes dark will lose events while it is down. If reliability is critical, keep your endpoint behind a highly available queue (SQS, Cloud Tasks) that accepts the POST and processes asynchronously.

What events are available?

One event type covers everything: domain.alert. The tier field (act_now, review, fyi) and the summary string tell you what happened. Typical signals include status changes, grace and redemption periods, pending delete, marketplace listings, auction appearances, DNS changes, SSL expiration, and registrar changes.

Other integrations