Improved

Webhook Notification Updates

New event type: INCIDENT_CLOSED

Webhooks now emit a dedicated event when an incident is closed, so downstream integrations no longer have to infer closure from a status change on MONITOR_STATUS_CHANGE. The payload includes the incident ID, link, name, issue number, status (CLOSED), and the list of compromised assets.

Updated: MONITOR_FAILURE

  • Added isMonitorAlreadyLinkedToIncident (boolean) at the top level, so consumers can tell whether this failure created a new incident or was added to an existing one.
  • The nested incident object now includes issue (the incident's issue number) and status (e.g. OPEN).

Updated: MONITOR_STATUS_CHANGE

  • The nested incident object now includes issue and status.

Updated: MONITOR_SUCCESS

  • The nested incident object now includes issue and status.

Why this matters

these changes let webhook consumers link notifications directly to the incident record and status without a separate API lookup, and cleanly distinguish incident-closed events from other status changes.