Webhooks

Webhooks connect dAio to your own systems. Instead of polling the platform continuously, you let dAio notify you: as soon as an event occurs — a weather alert triggered, a high risk detected — dAio sends a signed HTTP request in real time to the endpoint of your choice. This lets you automate your workflows: opening tickets, internal notifications, updating a business dashboard or triggering a field action plan.

It is the bridge between dAio's alerts and your information system.

Tip : start with a single webhook subscribed to one event type, validate the chain end to end, then expand. You will avoid flooding your systems with notifications before the processing is reliable.

Configuring a webhook

1. Go to Settings > Webhooks.
2. Click New webhook.
3. Enter the destination URL: your server's HTTPS endpoint (e.g. https://votre-serveur.com/webhook).
4. Select the events to listen to by clicking the corresponding labels.
5. Confirm with Create.

A secret is generated automatically on creation. It is used to sign each request with HMAC-SHA256 (see below): keep it on your server side, it lets you verify that every call genuinely comes from dAio.

Warning : the URL must be HTTPS and publicly accessible. An endpoint over plain HTTP or behind a closed firewall will not be able to receive deliveries.

Available events

Event	Description
weather.alert	A weather alert was triggered on a site
weather.threshold	A custom weather threshold was crossed
air_quality.alert	An air quality alert was issued
pollen.alert	A pollen alert was issued
marine.alert	A marine conditions alert was issued
frost.alert	A frost alert was triggered
storm.alert	A storm / tempest alert was triggered
business.risk_high	A high risk level was detected for your activity

Tip : subscribe each webhook only to the events actually used by the receiving system. A "tickets" endpoint does not need to receive the same events as a "dashboard" endpoint.

Payload format

Each delivery is a POST request whose body is a JSON object. The general structure is as follows:

{
  "event": "weather.alert",
  "timestamp": "2026-06-30T08:15:00Z",
  "data": {
    "site_id": 42,
    "site_name": "Entrepôt Nord",
    "severity": "high",
    "message": "Vent fort attendu (rafales > 80 km/h)"
  }
}

The event field identifies the event type, timestamp indicates the emission date (UTC, ISO 8601 format) and data contains the details specific to the event.

HMAC-SHA256 authentication

Each request is signed with your secret using HMAC-SHA256. The signature is transmitted in the X-Daio-Signature header, in the format sha256=<signature>.

Always verify this signature before processing a request: this is what guarantees that the call comes from dAio and that the payload has not been altered.

Server-side verification (Python):

import hmac, hashlib

def verify_webhook(payload, signature, secret):
    expected = hmac.new(
        secret.encode(), payload, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(f"sha256={expected}", signature)

Warning : compute the signature over the raw request body (the bytes received), before any JSON deserialization. The slightest reformatting changes the hash and makes verification fail.

Testing and debugging

• Click the Test icon (▶) next to a webhook to send a dummy event to your endpoint.
• An HTTP 2xx response confirms that your server has received and accepted the request.
• Expand the webhook to view its latest deliveries: HTTP code, event type and timestamp.
• A coloured dot indicates the webhook's status: green = active, red = disabled after repeated failures.

Delivery history

Every send is logged. Expand a webhook to see, for each attempt:

• The response HTTP code (green if < 300, red otherwise)
• The event type delivered
• The date and time of the attempt

A failure counter is displayed on the webhook when deliveries have failed.

Retries and reliability

dAio automatically retries delivery on failure, with increasing intervals. Your endpoint must therefore be idempotent: the same delivery may arrive several times, and your processing must produce the same result without side effects.

Warning : your endpoint must respond within 10 seconds with an HTTP 2xx code. Beyond that, or in case of an error code, the delivery is considered failed and will be retried. After repeated failures, the webhook is automatically disabled.

Best practices

• Always verify the HMAC signature before processing a payload: never trust an unauthenticated request.
• Respond fast: return a 200 immediately, then process the workload in the background. You avoid timeouts and unnecessary retries.
• Make your processing idempotent to safely absorb multiple deliveries.
• Filter at the source: subscribe each webhook only to the events useful to its receiving system.
• Monitor the failure counter and the delivery history to quickly detect a failing endpoint before it gets disabled.
• Use the Test button after every change on your side (deployment, URL change) to validate the chain without waiting for a real event.

Tip : pair your webhooks with alerts and your team configuration to automatically route the right information to the right system. Webhook availability depends on your subscription.