Outbound webhook format

Headers

• content-type: application/json
• x-augur-event: alert (or test for the test-alert button)
• x-augur-signature: sha256=<hex> — HMAC-SHA256 of the raw body, keyed with the per-channel signing secret you set under config in augur_alert_channels. Verify this to confirm the post is from us.
• user-agent: Augur/1.0 (+https://augur.news)

Body shape

{
  "source": "augur",
  "kind": "alert",
  "zone": {
    "id": "9c4b0c8a-...",
    "label": "Rotterdam port",
    "shape": "polygon",
    "min_severity": 60
  },
  "event": {
    "id": "usgs:us7000ngfx",
    "source": "usgs",
    "type": "earthquake",
    "severity": 72,
    "ts": "2026-05-25T09:14:33Z",
    "geo": { "lat": 51.95, "lon": 4.14 },
    "title": "M5.4 earthquake near Rotterdam, NL",
    "payload": { "mag": 5.4, "depth_km": 12, "place": "Rotterdam, NL" }
  },
  "explainer": "M5.4 quake 12km from the port. Above your severity threshold of 60. Last comparable event in the same polygon: 2024-11-02 (M4.9).",
  "dispatched_at": "2026-05-25T09:14:37Z"
}

Retry policy

Augur retries on HTTP 5xx and connection errors. 3 retries, exponential backoff (10s, 30s, 90s). Any 2xx response is considered a successful delivery — including 202 Accepted. 4xx responses are considered permanent and we stop retrying.

Verifying signatures (Node)

import crypto from "node:crypto";

function verify(body: string, header: string, secret: string): boolean {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(body).digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(header),
    Buffer.from(expected),
  );
}