Alerts: Slack, Discord, Teams, webhooks

Alert channels belong to the organization: one channel can receive alerts from every project in it. Owners and admins add them under Organization › Integrations › Alerts. Each channel chooses which kinds of alert it receives.

#Slack

1. 1

   Connect

   Press Connect Slack, sign in to your workspace and pick a channel. Sovaria receives that channel’s incoming-webhook URL from Slack. Or, manually: in Slack, Apps › Incoming Webhooks › Add to a channel, then paste the webhook URL.

2. 2

   Choose categories

   Leave all four on, or only the ones this channel should see (for example billing to a finance channel).

3. 3

   Send a test

   Test posts a sample alert so you can see it arrive.

Each alert is one message: the title in bold with the organization’s name, the first line of detail, and an Open in Sovaria link to the right page.

#Discord

Press Connect Discord and pick the server and channel, or create a webhook yourself: Channel settings › Integrations › Webhooks › New webhook › Copy webhook URL, and paste it. Messages are posted as Sovaria with the title in bold, the detail and the link.

#Microsoft Teams

Teams receives alerts through a workflow: in the channel, ••• › Workflows › “Post to a channel when a webhook request is received”, finish the workflow and copy its URL, then paste it in Sovaria. Messages arrive as Markdown with an Open in Sovaria link.

#Signed webhook

A signed webhook POSTs each alert as JSON to your endpoint, for paging tools, incident systems or your own service. The signing secret is shown once when you add it.

{
  "type": "security.new_device_sign_in",
  "category": "security",
  "org_id": "0f6c…",
  "title": "New sign-in from Chrome on macOS",
  "message": "priya@acme.co signed in from 103.21.x.x (Mumbai).",
  "link": "https://console.sovaria.in/account/security",
  "sent_at": "2026-10-20T08:14:03.551Z"
}

Verify the signature

Compute the HMAC over the exact bytes you received (not re-serialized JSON) and compare in constant time. Reject anything that doesn’t match.

import crypto from 'node:crypto';

// raw: the exact request body bytes; secret: shown once when you added the integration
export function verifySovaria(raw: Buffer, header: string | undefined, secret: string): boolean {
  if (!header?.startsWith('sha256=')) return false;
  const expected = crypto.createHmac('sha256', secret).update(raw).digest('hex');
  const got = header.slice('sha256='.length);
  return got.length === expected.length && crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected));
}

#Delivery

• Alerts are sent as they happen and never hold up the action that raised them. Each attempt waits up to 6 seconds for your endpoint.
• Any 2xx response counts as delivered. Other statuses and timeouts are recorded on the channel as its last error, with the time.
• URLs must be public https:// addresses; private and internal addresses are refused, and redirects aren’t followed.
• Pause stops a channel without losing its settings; Remove deletes it and its stored URL and secret.

#If alerts don’t arrive

• Press Test and read the channel’s last error: HTTP 404 usually means the webhook was deleted on the vendor’s side; reconnect it.
• Check the channel’s categories: an alert only goes to channels that include its category.
• For signed webhooks, log the raw body and the header your server received and run the verify function above on them.