Alert Webhooks

Augmentt can POST a JSON payload to an HTTPS endpoint you control each time a Secure alert is generated for a tenant. Use this to feed alerts into a SIEM, SOAR, or custom automation instead of (or in addition to) email and PSA tickets.

Webhooks are configured once per Augmentt organization and then switched on per tenant.

Prerequisites

• The tenant must be licensed for Secure.

• An HTTPS endpoint that accepts POST requests with a JSON body and returns a 2xx status.

• The header name and value you want Augmentt to send for authentication (see Authentication below).

Step 1: Request webhook enablement

Webhook configuration is set up by Augmentt Support; there is no self-serve configuration screen yet.

Click Contact Us in the upper-right corner of Augmentt and submit a ticket that includes:

1. Destination URL – the full HTTPS URL Augmentt should POST to.

2. Authentication header(s) – the header name and value your endpoint expects (for example Authorization: Bearer YOUR_TOKEN or x-api-key: YOUR_KEY).

Credentials are stored encrypted. If you later need to change the key or the URL, submit a new ticket.

Support will confirm once the webhook is enabled for your organization.

Step 2: Enable webhooks per tenant

Once enabled, go to Secure > Alerts, choose All Companies from the company selector, and open the Companies tab. A webhook icon appears under Notifications Enabled next to the existing email and PSA icons.

Enable the webhook icon for each tenant that should send alerts to your endpoint. You can also toggle it from the Options (…) > Edit recipients pop-up for a tenant.

One webhook destination serves all tenants in your organization; the per-tenant toggle only controls which tenants send.

When a webhook is sent

A webhook is sent for an alert when all of the following are true:

• Severity levels, lowest to highest: informational, low, medium, high. An alert type with threshold medium sends webhooks for medium and high alerts only.

• Webhooks follow the same per-alert-type notification setting as email and PSA notifications. There is no separate webhook-only list of alert types.

• Notifications are suppressed during the first alert ingestion after a tenant is connected, so existing historical alerts are not sent. Only alerts generated after that point trigger webhooks.

• Alerts that were auto-remediated still send a webhook; the outcome is included in the payload.

• One request is sent per alert.

Request format

POST https://your-endpoint.example.com/augmentt
Content-Type: application/json
User-Agent: augmentt-notify/1.0
Authorization: Bearer YOUR_TOKEN   (or whichever header you configured)

Payload

{
  "resource": "alert",
  "eventType": "alert_created",
  "organizationId": 1234,
  "customerId": 5678,
  "integrationContext": {
    "parentTenantId": "9f2a1c3e-0000-0000-0000-000000000001",
    "tenantId": "b7c4d5e6-0000-0000-0000-000000000002"
  },
  "alert": {
    "customer": "Contoso Ltd",
    "alert_type": "office365_newadminwithoutmfa",
    "alertType": "office365_newadminwithoutmfa",
    "id": "a1b2c3d4-...",
    "title": "New Admin without MFA",
    "description": "A new administrator was detected without MFA enabled.",
    "severity": "high",
    "eventDateTime": "2026-10-13T14:21:47.381Z",
    "userStates": [{ "aadUserId": "user-object-id" }],
    "targetUserStates": [{ "id": "target-user-object-id" }],
    "user_name": "First Last",
    "target_user_name": "First Last",
    "eventSettings": {},
    "autoRemediation": [],
    "autoRemediationStatus": null
  }
}

Field reference

The fields in alert vary by alert type. Sign-in alerts carry location and IP fields, device alerts carry deviceDetails, conditional access alerts carry caPolicyDetails, mailbox alerts carry mailboxDetails, and posture alerts carry complianceMetadata. The fields listed above are present across alert types; design your receiver to tolerate additional fields.

Authentication

Augmentt authenticates to your endpoint with static request headers that you supply when requesting enablement. Any header name and value can be used, for example:

• Authorization: Bearer YOUR_TOKEN

• x-api-key: YOUR_KEY

Header values are stored encrypted and sent on every request. Augmentt does not currently sign payloads (no HMAC signature header) and does not support OAuth client-credential flows or mutual TLS.

Recommended verification on your side:

1. Reject requests that do not carry your expected header value.

2. Use an HTTPS endpoint only.

Delivery behavior

• Augmentt treats any 2xx response as delivered. Return quickly and process asynchronously if your pipeline is slow.

• Delivery happens as part of alert ingestion. Timing depends on when Microsoft makes the underlying event available; sign-in related alerts sourced from the Unified Audit Log can lag the event by some time.

Troubleshooting

Only one tenant is sending webhooks. The per-tenant webhook toggle under Secure > Alerts > All Companies must be enabled for each tenant individually.

Some alert types never arrive. Check Secure > Alerts > Settings: the alert type must be enabled, its notification bell must be on, and the alert's severity must meet the threshold.

No webhooks at all after enablement. Confirm your endpoint is reachable from the public internet over HTTPS and returns 2xx. Then open a support ticket; Support can confirm from delivery logs whether requests were sent and what status your endpoint returned.

Related

• Enable Alert Notifications

• How Alerts Work

• Alert Auto-Remediation

• Augmentt API