Category filter
Configure Custom Webhook Endpoints for Real-Time IT Alerts
If you want to route real-time Hexnode UEM alerts to your organization’s own servers, internal dashboards, or third-party IT Service Management (ITSM) and Security Information and Event Management (SIEM) platforms, you can set up a custom webhook endpoint.
This guide outlines the technical requirements and steps to successfully connect Hexnode UEM to your custom destination.
Supported endpoint requirements
To successfully receive data from Hexnode UEM, your custom destination server must meet the following criteria.
HTTP method and content type
Hexnode UEM delivers all alert notifications using an HTTP POST request. The destination server must be configured to accept this method. The data payload attached to this request is formatted as standard JSON, so the endpoint must be able to parse application/json content types.
URL requirements
You must provide a fully qualified endpoint URL.
- The URL must begin with either
http://orhttps://(HTTPS is highly recommended to ensure the alert data is encrypted during transit). - The endpoint must be accessible over the public internet so that Hexnode UEM can reach it.
Authentication options
To ensure your server only accepts legitimate alerts from Hexnode UEM, you can configure authentication. Hexnode UEM supports the following methods:
- No authentication: The endpoint requires no credentials.
- Basic authentication: Hexnode UEM will pass a standard Username and Password to your server.
- Access token: Hexnode UEM will pass a security token. You can choose the format your server expects: Bearer, Basic, Custom, or None (which passes the token without a specific prefix).
Expected acknowledgment response
When Hexnode UEM sends an alert, it waits for the destination server to confirm receipt. Your custom endpoint should be configured to immediately return a successful HTTP status code (such as 200 OK, 201 Created, or 202 Accepted) upon receiving the payload.
Timeout behavior
When configuring the webhook in Hexnode UEM, you will set a Timeout (in seconds). This is the maximum time Hexnode UEM will wait for your server’s HTTP acknowledgment response. If your server is down or takes too long to respond, Hexnode UEM will drop the connection, and the delivery attempt will fail.
Sample request
When a configured event occurs, Hexnode UEM pushes a JSON payload containing the event details. While the exact fields will vary depending on the specific alert (e.g., device compliance vs. app installation failure), a standard payload structure looks like this:
{
“Event_Name”: “Device enrolled”,
“Event_Time”: “2026-07-17 07:25:09 AM”,
“Portal_Name”: “admin-console.hexnodemdm.com”,
“Message”: “The device with Device ID: 7, has been enrolled in your Hexnode UEM portal and assigned to the user Default User at 07:25 AM today, on Jul 17, 2026.”
}
Configure the endpoint in Hexnode UEM
Once your custom server is ready to receive POST requests, configure the connection in your portal.
- Log in to the Hexnode UEM portal.
- Navigate to Admin > Webhook.
- Click on Add New.
- Enter an identifiable name for the integration (e.g., “Internal SIEM Alerts”).
- Paste your destination URL into the URL field.
- Enter a value for Timeout (in seconds) based on your server’s average processing time.
- Select your required Authentication method and provide the necessary credentials or tokens.
- Click Save.
Note: To start receiving live alerts, you must navigate to Admin > Alert Profiles and select this newly saved webhook under Step 2: Actions.
Test with a request-inspection service
Before sending alerts to a live production database or a complex ITSM tool, it is highly recommended to test the webhook.
You can use free, web-based request-inspection tools (like Webhook.site or RequestBin) to generate a temporary URL. Paste this temporary URL into Hexnode UEM and click the Test button. This allows you to visually inspect the exact JSON payload, headers, and formatting that Hexnode UEM sends, helping your developers understand how to process the incoming data.
Connect through middleware
Hexnode UEM sends its alert data in a specific, fixed JSON format. However, some ITSM or SIEM platforms require incoming data to be structured in their own unique formatting.
Because Hexnode UEM does not offer native payload transformation for every third-party platform, you may need to use middleware. If your target platform rejects the standard Hexnode UEM payload, you can route the webhook through an automation service or a custom script hosted on your own server. This middleware will receive the Hexnode UEM payload, map the data to the correct fields, and forward it to your target application.
Production deployment checklist
Before relying on your custom webhook for critical IT alerts, verify the following:
- Security: The endpoint URL uses
https://and an authentication method is actively configured. - Response time: The endpoint responds with a 200 OK status well within the configured Hexnode UEM Timeout window.
- Alert Profile linked: The webhook is actively selected inside an Alert Profile, and the event triggers are properly defined.
- Middleware stability: If using a transformation script or middleware tool, it has been tested against various alert types (e.g., enrollment, compliance) to ensure all variables map correctly.
