Alert webhooks

1. In RevHost, open Settings → Alerts and find Send alerts to your own tools.
2. Choose Add Webhook, paste your https URL, and pick the alerts to send. For location alerts you can narrow it to specific locations, and to specific vehicles for any alert.
3. Copy the signing secret. It starts with whsec_ and is shown only once.
4. Choose Send Test Event. RevHost posts an alert.test event and shows what your URL answered.

Webhooks are free on every plan. Each account can have up to 5. The account owner and their Admins can manage them; Workers cannot.

A webhook gets every alert you chose for it, even ones you have muted or switched off for yourself. Muting is about who gets interrupted; to stop an alert reaching your tool, take it off the webhook.

Anyone who learns your URL can post to it. The signature proves a request came from RevHost and was not changed on the way. Check it against the raw body, before parsing it as JSON: re-serialising changes the bytes and the check fails.

import crypto from 'node:crypto';

// rawBody: the request body exactly as received, before any JSON parsing.
export function verifyRevHostWebhook(rawBody, headers, secret) {
  const id = headers['webhook-id'];
  const timestamp = headers['webhook-timestamp'];
  const signatures = (headers['webhook-signature'] ?? '').split(' ');
  // Refuse anything older or newer than 5 minutes (replay protection).
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
  const expected = crypto
    .createHmac('sha256', key)
    .update(`${id}.${timestamp}.${rawBody}`)
    .digest('base64');

  return signatures.some((s) => {
    const [version, signature = ''] = s.split(',');
    return (
      version === 'v1' &&
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
    );
  });
}

app.post('/revhost-webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const rawBody = req.body.toString('utf8');
  if (!verifyRevHostWebhook(rawBody, req.headers, process.env.REVHOST_WEBHOOK_SECRET)) {
    return res.status(401).end();
  }
  res.status(200).end(); // answer first, then do the work
  handleEvent(JSON.parse(rawBody));
});

• The key is the part of the secret after whsec_, base64-decoded. The signed text is id.timestamp.body.
• After you choose Roll Secret, requests carry signatures from both the old and the new secret for 24 hours. Accept a request if any signature matches, and update your secret within that window.
• Compare in constant time, as the snippet does.
• To test your verifier, the example headers and body above are genuinely signed with the example secret whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw. It belongs to no account. Set your clock to the example timestamp, or skip the 5-minute check, when you try it.

Post “arrived” and “left” for one lot into a Telegram chat. Five minutes, no code.

1. In n8n, add a Webhook node. Set the method to POST and copy its production URL. Activate the workflow so that URL is live.
2. In RevHost, add a webhook with that URL. Tick Arrived at the location and Left the location, and under Which locations? choose your lot. Send a test event and check it arrives in n8n.
3. Optional, if one webhook carries several locations: add an If node that compares {{ $json.body.data.geofence.name }}with the location’s name.
4. Add a Telegram node, operation Send Message, with your bot credentials and chat ID, and this text:

{{ $json.body.data.alert.typeLabel }}: {{ $json.body.data.vehicle.name }} ({{ $json.body.data.vehicle.licensePlate }})
{{ $json.body.data.geofence.name }}
{{ $json.body.data.alert.mapsUrl }}

The test event is alert.test with a sample vehicle and a location called “Home Lot (test)”, so it reaches Telegram unless the If node filters it out. To skip test events everywhere, add an If node on {{ $json.body.type }} equal to alert.createdif you would rather it didn’t. To check signatures in n8n, run the verify code above in a Code node against the request’s raw body.

Everything in Settings is also available at https://api.revhosthq.com/v1/webhook-endpoints, with a Personal Access Token that has the webhook:write permission. A token without it is refused, even for reading.

• GET /v1/webhook-endpoints
• POST /v1/webhook-endpoints { url, description?, eventTypes, geofenceIds?, vehicleIds? }
• PATCH /v1/webhook-endpoints/:id { …same fields, status: "active" | "disabled" }
• DELETE /v1/webhook-endpoints/:id
• POST /v1/webhook-endpoints/:id/rotate-secret
• POST /v1/webhook-endpoints/:id/test
• GET /v1/webhook-endpoints/:id/deliveries

The secret is in the response to create and rotate-secret only. RevHost emails the account owner whenever a webhook is added, its URL changes, or it is resumed.