Slack incoming webhook for outages
Short answer
Post a down and a recovery into a Slack channel with an incoming webhook on hooks.slack.com. Pro and Business only. The recovery is a second message.
How The Watchbill helps
- On Pro and Business, a down check can email the address your ticket system already turns into a ticket.
- The recovery message uses that same path.
- Email alerts are included on every plan, including Free.
This guide explains how a confirmed outage posts into a Slack channel, and why the URL has to be the incoming webhook Slack gives you.
Create a Slack app, add an incoming webhook, pick the channel, and paste the URL from hooks.slack.com on the Slack card. A down posts one message. A recovery posts a second message. There is no button and no acknowledge action. A client can use a different channel. Send a test only into a channel that can stand one.
Why an incoming webhook
Slack's incoming-webhook page says you create an app, add the incoming-webhook scope, install the app, and receive a URL on hooks.slack.com. A POST of JSON to that URL posts into the channel you chose when you created the webhook. The URL is the credential. Anyone who has it can post. Slack does not ask for a second signature on that request.
That is the same shape as a Teams Workflows URL. One address, one JSON body, one message on the way down and another on the way up. It is not a Slack app published by The Watchbill. You create the app in the workspace that should receive the posts. Marketplace review is Slack's process for an app you distribute to other workspaces. This path does not do that.
Block Kit is the layout Slack documents for those messages. The Block Kit page allows up to 50 blocks. A header is plain text. A section can be mrkdwn. Interactive pieces, such as a button that calls back into an app, need a request URL on a Slack app. This message does not include them. A person who needs to ack an incident does that in Slack, or in PagerDuty, not from a button on this post.
Create the webhook
In the Slack workspace, create an app. Add the incoming-webhook feature and the incoming-webhook scope. Install the app to the workspace. Choose the channel. Copy the webhook URL. Slack's page shows that URL on hooks.slack.com, under /services/, with three segments after that.
Paste it on Alerting, then Slack, and save. There is no signing-secret field. The URL is stored encrypted and it is not shown again. If you need a second channel, create a second webhook and add a second Slack destination. Do not reuse one URL and hope the channel changes. The channel is chosen in Slack when the webhook is created.
The host has to be hooks.slack.com. The path has to be /services/ and then three segments of letters, digits, underscores, or hyphens. A query string, a fragment, or a username in the URL is rejected. A host that only looks like Slack, such as hooks.slack.com.evil.example, is rejected. Office chat URLs and a generic webhook you run yourself belong on the other cards.
What the channel sees
The payload has a top-level text field and a short list of blocks. Slack's incoming-webhook page says text is the notification fallback, and that screen readers use it when it is present. The text repeats the headline, the summary, and the target URL, so a notification still says which check moved.
The blocks are a header, a section for the summary, and a section for the link when the target is a normal URL. The header is the state and the check name, such as Down: Northwind booking. The link is Slack mrkdwn, written as the URL between angle brackets. A target that itself contains an angle bracket or a pipe is sent as plain text, because those characters would break the link markup. There is no image, no button, and no overflow menu.
A recovery is a second message. Slack is not asked to edit or delete the first one. If the channel should show one thread that opens and closes, that is a Slack app with chat.update, which this destination does not call. If the contract needs one ticket, use ticket email beside the channel. The channel is where a person sees the words. The ticket is where the clock runs.
A test sends the same shape and can post into the real channel. Pick a channel that can stand a test, or delete the test message after you see it. The checking mail and the first confirmed up do not post here. Those stay on email.
A different channel per client
The account URL is the default for clients that inherit the account set. On the client, choose Use a set on this client and check the Slack destination that posts to that client's channel. You can also assign one destination to selected clients. Clients that inherit the account set and are not selected will not get that destination. Clients that already have their own set keep it until you edit the set.
A check can replace the client set. Use that only when one target should post somewhere the rest of the client should not. The alerting list names the clients that use each destination. All clients means every client that inherits the account set.
If the message never appears
Confirm the host is hooks.slack.com and that the app is installed in the workspace that owns the channel. Slack's rate-limit page says an incoming webhook is about one message per second, with short bursts, and that a limit answers HTTP 429 with Retry-After. A confirmed outage is two messages, minutes apart, so that limit is not the normal case. A 429 or a 500 is retried on the same gaps as a signed webhook: 60 seconds, 5 minutes, 15 minutes, and 60 minutes. The send waits 8 seconds. A 400-class response other than 429 stops. Five terminal failures turn the destination off and email the account once.
If the channel is private, the app has to be allowed to post there. That permission is Slack's. This guide does not name a workspace plan. If the paste is rejected, the usual cause is a copied URL from a different product, or a URL that still has a query string.
Rotate a leaked URL in Slack by removing that webhook and creating another. Saving the new URL here replaces the stored one. The old URL is not kept.
Name the destination after the channel, not after the person who clicked Install. When that person leaves the workspace, the webhook can keep working, but the app they created may be removed with them. A workspace admin can own the app if your process says the app should outlive one login. This guide does not claim a specific admin menu, because Slack's app console moves. Follow the incoming-webhook page cited above if a button name differs.
Keep the channel beside the ticket when the agreement says every client incident has a number. A Slack message does not open that ticket. It also does not close one. The recovery line in the ticket mail is a separate card.
How The Watchbill helps
On Pro and Business, a Slack incoming webhook receives a message when a confirmed outage opens and another when it closes. The URL has to be on hooks.slack.com. A client can use a different channel. The checking test and the first confirmed up do not post to Slack.
Sources
Checked 12 Oct 2026.