Webhooks

Webhooks push detections to your systems as they are raised, instead of polling.

Discord

The quickest route. Under Settings → Alerts, link a Discord server and pick channels for alerts, reports and logs. Detections below your accuracy threshold are recorded but not announced.

Report webhook

Under Settings, set a Report webhook URL to receive player reports as JSON:

{
  "type": "player_report",
  "organizationId": "…",
  "serverId": "…",
  "reportedPlayer": { "uuid": "…", "username": "…" },
  "reporter": { "uuid": "…", "username": "…" },
  "reason": "…",
  "createdAt": "2026-09-14T12:00:00Z"
}

Handling deliveries

• Respond 2xx quickly and do the work asynchronously; slow endpoints are retried and may be backed off.
• Expect the same delivery more than once. Deduplicate on the detection id.
• Treat every field as untrusted input — usernames are player-controlled. Escape before rendering or logging into anything that interprets markup.

Verifying deliveries

Each network is issued a signing secret, shown in network settings and recognisable by its whsec_ prefix. It is the key for an X-Thorium-Signature HMAC over the request body.

Note

The secret is issued, but the sender does not yet attach the signature header. Until it does, treat your endpoint URL as a bearer capability — keep it secret, and confirm anything important against the API before acting on it. Once signatures are being sent, verify every delivery and reject those that fail.

Rotating the secret is a matter of writing a new value in network settings; deliveries signed with the previous one stop verifying immediately.