Inbound webhooks

Inbound webhooks receive events from other tools and turn them into tickets or updates. There are three entry points:

Source	Address	Configuration in Core
Monitoring, DevOps and security tools	/api/connectors/{vendor}/{tenant}	Integrations, the vendor’s connector
Other ITSMs and generic REST sources	/api/integration/webhook/{integration_id}	Integration Center
On-premises SNMP gateway	/api/snmp-gateway/trap/{tenant}	Integrations → SNMP gateway

All addresses are on https://exocortex-api.ai-exo-cortex.com.

Connectors for monitoring, DevOps and security tools

You configure the connector in exoCortex Core, then point the tool’s webhook to the connector address. The tool sends its native format: exoCortex normalises it and, when needed, opens a ticket.

Supported tools:

• Monitoring: Datadog, New Relic, Prometheus, Grafana, Nagios, Icinga, Centreon, Statuspage, NinjaOne.
• DevOps and on-call: GitHub, GitLab, Jenkins, Bitbucket, PagerDuty, Opsgenie.
• Security: Wazuh, Microsoft Sentinel, Tenable, Qualys, Splunk, Elastic, CrowdStrike, SentinelOne, QRadar, Cyber Protect, Fortigate, Check Point and network EDR probes.

In the address, {vendor} is the tool name in lower case (for example datadog) and {tenant} is the code of the tenant you configured the connector for.

Authentication

• GitHub, GitLab, PagerDuty, Opsgenie and Statuspage sign requests with their own mechanism: exoCortex verifies it.
• For all other tools you use the exoCortex signature, calculated with the connector secret (see Signing requests).

If a connector fails several times in a row, exoCortex temporarily suspends requests and responds 503 with resume_in_ms, the number of milliseconds after which to retry.

ITSM integrations and bridges

For ServiceNow, Jira, Zendesk, BMC or a generic REST source, you configure the integration in the exoCortex Core Integration Center, with the field mapping. The other system sends events to the integration address; exoCortex maps them and creates or updates the ticket.

The signature is mandatory when the integration has a secret, and integrations in webhook mode must have one. Use the exoCortex signature; alternatively, X-Bridge-Signature, X-Hub-Signature-256 or X-Signature with the value sha256=<hex HMAC of the body> are accepted.

The response is 200 when the event was processed immediately, 202 when it was queued for reliable processing.

Signing requests

To sign a request to exoCortex, send two headers:

• X-Exo-Timestamp: the current time in Unix seconds;
• X-Exo-Signature: v1= followed by the hex HMAC-SHA256 of timestamp + "." + body, calculated with the connector secret.

exoCortex rejects requests whose timestamp differs from its own time by more than 300 seconds.

ts=$(date +%s)
body='{"title":"CPU high on web-01","alert_type":"error"}'
sig=$(printf '%s.%s' "$ts" "$body" | openssl dgst -sha256 -hmac "$CONNECTOR_SECRET" -hex | sed 's/^.* //')
curl -X POST "https://exocortex-api.ai-exo-cortex.com/api/connectors/datadog/ACME" \
  -H "Content-Type: application/json" \
  -H "X-Exo-Timestamp: $ts" -H "X-Exo-Signature: v1=$sig" \
  --data-binary "$body"

The X-NH-Connector-Signature header, with the HMAC of the body only, is deprecated and works until 30 June 2027.

SNMP gateway

If you have devices that send SNMP traps, a gateway in your network converts them to JSON and sends them to exoCortex. You set the secret in Integrations → SNMP gateway.

The gateway signs each request with:

• X-NH-SNMP-Timestamp: the current time in Unix milliseconds;
• X-NH-SNMP-Signature: sha256= followed by the hex HMAC-SHA256 of timestamp + "|" + body.

The time tolerance is 5 minutes. An example trap:

{
  "source_ip": "192.0.2.10",
  "source_sysname": "core-sw-01",
  "trap_oid": "1.3.6.1.6.3.1.1.5.3",
  "severity": "major",
  "varbinds": {
    "1.3.6.1.2.1.2.2.1.1": "12",
    "1.3.6.1.2.1.2.2.1.2": "GigabitEthernet1/0/12"
  }
}