Webhooks & Alerting
How to configure webhooks for system event delivery and set up alert rules for automated notifications in Barfinex Studio.
Webhooks and alerting let you receive notifications when important events happen in your Barfinex stack — signals, AI decisions, risk actions, service outages, and more.
Webhooks
Creating a webhook
- Open Studio → Webhooks.
- Click Create Webhook.
- Fill in the configuration:
| Field | Required | Description |
|---|---|---|
| Name | Yes | Human-readable label for the webhook. |
| URL | Yes | The HTTPS endpoint that will receive POST requests. |
| Events | Yes | One or more event types to subscribe to. |
| Secret | No | A shared secret used for HMAC signature verification. |
| Active | Yes | Whether the webhook is currently enabled. |
- Click Save. Studio will send a test ping to verify the URL is reachable.
Available event types
| Event type | Fires when |
|---|---|
signal.emitted | Detector emits a new trading signal. |
decision.made | Advisor produces a decision (execute, skip, or reject). |
risk.blocked | Inspector blocks an execution intent due to a risk policy violation. |
order.placed | An order is placed on the exchange through Inspector. |
order.filled | An order is fully filled on the exchange. |
service.up | A previously unreachable service becomes healthy. |
service.down | A connected service becomes unreachable. |
deployment.created | A new service deployment is created through a wizard. |
deployment.updated | A deployed service configuration is changed. |
deployment.deleted | A deployed service is removed. |
Payload format
Each webhook delivery is an HTTP POST with a JSON body:
{
"id": "evt_abc123",
"type": "signal.emitted",
"timestamp": "2026-03-27T12:00:00.000Z",
"data": {
"symbol": "BTCUSDT",
"direction": "LONG",
"score": 0.82
}
}
The data field varies by event type.
HMAC signature verification
If you configure a Secret on the webhook, every delivery includes an X-Barfinex-Signature header containing an HMAC-SHA256 signature of the request body.
To verify:
- Compute
HMAC-SHA256(secret, raw_request_body). - Compare the result with the value in
X-Barfinex-Signature. - If they match, the payload is authentic and unmodified.
Example (Node.js):
const crypto = require('crypto');
function verifySignature(secret, body, signature) {
const expected = crypto
.createHmac('sha256', secret)
.update(body, 'utf8')
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(expected),
Buffer.from(signature)
);
}
Delivery and retries
- Studio delivers webhooks with a 10-second timeout.
- If the endpoint returns a non-2xx status, Studio retries up to 3 times with exponential backoff (10s, 30s, 90s).
- Failed deliveries are visible in the webhook's delivery history.
- You can manually retry a failed delivery from the Studio UI.
Alerting
Alert rule types
| Rule type | Condition | Example use case |
|---|---|---|
| No signals | A strategy has not emitted a signal for N minutes. | Detect a stuck or misconfigured strategy. |
| Drawdown threshold | Portfolio drawdown exceeds N%. | Get notified before losses escalate. |
| Service down | A connected service is unreachable for N seconds. | React quickly to infrastructure failures. |
Creating an alert rule
- Open Studio → Alerting.
- Click Create Rule.
- Select the rule type and configure parameters:
- For No signals: select the strategy and the silence threshold (minutes).
- For Drawdown threshold: set the percentage threshold.
- For Service down: select the service and the unreachable threshold (seconds).
- Under Delivery, select one or more webhooks to receive the alert notification.
- Click Save.
Connecting alerts to webhooks
Alert rules do not deliver notifications on their own. Each rule must be connected to at least one webhook.
When the alert condition is met:
- Studio evaluates the rule.
- If triggered, Studio sends a webhook delivery with event type
alert.triggered. - The payload includes the rule type, threshold, and current value.
Example alert payload:
{
"id": "evt_def456",
"type": "alert.triggered",
"timestamp": "2026-03-27T12:05:00.000Z",
"data": {
"rule": "drawdown_threshold",
"threshold": 5.0,
"current_value": 5.3,
"message": "Portfolio drawdown exceeded 5.0% (current: 5.3%)"
}
}
Delivery channels
Webhooks can point to any HTTP endpoint, so you can deliver alerts to:
- Slack — use a Slack Incoming Webhook URL.
- Telegram — use a Telegram Bot API URL with your chat ID.
- PagerDuty — use the PagerDuty Events API v2 endpoint.
- Custom services — any HTTPS endpoint that accepts POST requests.
Troubleshooting
| Problem | Solution |
|---|---|
| Webhook shows "unreachable" | Verify the URL is accessible from your network and returns a 2xx response to POST requests. |
| Signature verification fails | Ensure you are using the raw request body (not parsed JSON) for HMAC computation. |
| Alerts not firing | Check that the alert rule is connected to at least one active webhook. |
| Duplicate deliveries | This can happen during retries. Use the id field to deduplicate on your end. |