pinecall webhook
Where the org's alerts are posted: a URL of its own, every post signed, proven with a test.
$ printf %s "$WEBHOOK_SECRET" | pinecall webhook set https://hooks.example.com/pinecall --secret
alerts go to https://hooks.example.com/pinecall · signed
$ pinecall webhook test
the URL took it: a signed webhook.test post answered 2xx
$ pinecall webhook
alerts go to https://hooks.example.com/pinecall · signedWhere this org's alerts are posted beyond the agent's log: a URL of your own — Slack, PagerDuty,
your backend. Every alert — a monitor that fired (monitor.fired), today's spend three times
the usual (spend.unusual), a quota that ran out (credits.exhausted) — is posted as it is
written, as JSON {type, org, env, agent, at, data} with x-pinecall-event naming the type,
tried twice within five seconds; a URL that fails is logged and the log keeps the alert. set
takes the URL on the command line and, with --secret, the secret from stdin — typed without echo
on a terminal, or piped — never from a flag; with a secret every post carries
x-pinecall-signature: sha256=<HMAC-SHA256 of the body>. The gateway keeps the secret sealed and
never reads it back: the bare verb prints the URL and whether posts are signed. test posts one
webhook.test event, signed the same way, and exits 1 if the URL did not answer 2xx. clear
stops the posting. What the console's bell tells each person is their own choice, under
Notifications; the webhook is the org's. Alerts has a
verification snippet per language.