Alerts

Alerts turn important vault activity into timely notifications. You can send selected events to the vault owner by email, deliver them to your own HTTPS endpoint, or post them directly to Slack and Discord.

#How alerts work

Each alertable vault event has an action, category, and severity. When an event occurs, SikkerKey compares its action with your saved email and webhook subscriptions, then sends it through every matching notification channel.

Available event categories include Secrets, Machines, Projects & Applications, Authentication, Organizations & SSO, Sessions, AI Agents, Billing, Webhooks, IP Allowlist, Integrations, and Temporary Secrets.

Email alerts and individual webhooks each have their own event selection, so every destination can receive the activity most relevant to its audience.

#Configure email alerts

Email alerts are sent to the vault owner’s account email and include the action, available detail, affected secret, actor, and source IP.

Email-alert availability is set by your subscription plan. The Billing page shows the email-alert features included with each plan.

#Create a webhook

Webhooks deliver matching events as JSON over HTTPS or as a formatted message in a chat channel.

#Receive signed JSON

The SikkerKey integration generates a signing secret when the webhook is created. Save it securely or reveal it later from Configure webhook. Each reveal is recorded in your vault activity.

Every signed request includes these headers:

Verify the signature against the raw request body before parsing or processing the JSON:

import { createHmac, timingSafeEqual } from 'node:crypto'

export function verifySikkerKeyWebhook(rawBody, signature, secret) {
  const expected = createHmac('sha256', secret)
    .update(rawBody)
    .digest()
  const received = Buffer.from(signature, 'hex')

  return received.length === expected.length &&
    timingSafeEqual(received, expected)
}

The JSON body has this shape:

{
  "id": "delivery-uuid",
  "event": "secret_read_denied",
  "severity": "high",
  "timestamp": 1784755200000,
  "data": {
    "actor": {
      "type": "machine",
      "name": "production-api",
      "id": "actor-uuid"
    },
    "secretId": "secret-id",
    "sourceIp": "203.0.113.42",
    "detail": "Request denied by access policy"
  }
}

The actor, secret ID, source IP, and detail fields are populated when they apply to the event. Use the delivery ID as an idempotency key so repeated attempts are processed once.

#Test and manage webhooks

Each webhook row shows its provider, endpoint, selected-event count, status, last successful delivery, recent failures, and the latest error.

• Send test delivers an Info-level test event to that endpoint, including while the webhook is paused.

• Configure changes the endpoint, event selection, and enabled state. Signed JSON webhooks also provide reveal and copy controls for the signing secret.

• Disable pauses event delivery while keeping the configuration.

• Enable resumes delivery and starts the health status with a clean failure count.

• Delete removes the webhook configuration.

#Delivery attempts and health

SikkerKey queues webhook notifications and makes up to three delivery attempts with increasing delays. All attempts for one event use the same delivery ID, which supports safe deduplication at your endpoint.

A 2xx response marks the webhook healthy, clears its recent failure count, and updates Last delivered. A failed delivery marks it unhealthy and displays the latest error. After ten consecutive failed deliveries, SikkerKey pauses the webhook so you can correct and test the endpoint before enabling it again.

Webhook delivery targets the URL you configure directly. Enter the final endpoint URL so the receiver can accept the POST and return its 2xx response.

#Webhook delivery allowance

Your plan sets the number of webhook deliveries available to the vault each UTC day. The Alerts page shows today’s usage, the plan limit, and the time of the next reset.

• One matching event sent to one webhook uses one delivery.

• The same event sent to multiple webhooks uses one delivery for each destination.

• A Send test request uses one delivery.

• Automatic attempts for the same queued notification remain part of that single delivery.

#Control access to Alerts

Vault owners can view and manage alert settings. Organization members receive access through their vault role.

• View alerts provides read access to email preferences, webhook configurations, health, and delivery usage.

• Manage alerts adds the ability to change email subscriptions and create, test, configure, enable, disable, reveal signing secrets for, and delete webhooks.