Webhooks

What you get

Every webhook subscription pings your URL when the events you chose fire. Each request is signed with HMAC-SHA256 against your subscription secret so you can verify it's actually us.

Events you can subscribe to

• member_join — new member joins one of your servers
• member_leave — member leaves
• mod_action — ban / kick / timeout / warn issued
• mod_case_appealed — member appealed a case
• ticket_open / ticket_reply — support ticket events
• report_filed — Discord member-report submitted
• support_chat / support_reply — public-widget chat
• anomaly_alert — anomaly worker fires
• bot_offline — bot reports degraded health
• release_deployed — new dashboard build went live

Set up

1. Open the dashboard → Account → Webhooks.
2. Create a subscription. Enter your URL, pick the events you want.
3. We give you a secret once— copy it now. We store it encrypted; we can't show it to you again.
4. Verify your endpoint with the Test button. We POST a synthetic webhook.test event so you can confirm signature verification works before relying on it.

Verifying signatures

Every request includes an X-Sloth-Signature header with the prefix sha256=followed by the HMAC of the raw request body. Compute the same on your side and reject any request where the values don't match.

# Python
import hmac, hashlib

def verify(body: bytes, signature: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

Retry semantics

Non-2xx responses or timeouts trigger exponential backoff: 1 minute, 5 minutes, 30 minutes, 2 hours. After four consecutive failures the subscription is auto-paused — you'll see it flagged in the dashboard with the last error. Resume from there once you've fixed the receiver.

Limits by tier

• Free: 3 active subscriptions per account.
• Premium: 20 subscriptions.
• Enterprise: 100 subscriptions.

Caps are enforced at create-time with a 402 response carrying the upgrade CTA shape — easy to surface inline if you're building a dashboard around Sloth Lee's API.