What it is
Generic JSON POST. The body carries report metadata, the rendered HTML and the attachment as base64.
Set up
About 5 minutes to a working channel.
- 01Have an endpoint that accepts POST. It must accept application/json and answer 2xx. Anything else is recorded as a delivery failure with the status code and body. To try it without writing code, webhook.site gives you a URL that shows every request live.
- 02Paste the URL, then Test. Test posts a tiny probe body, not the real shape. The delivery payload is the larger envelope described in the payload reference below.
- 03Optional: sign the payload. With an HMAC secret set, every request carries X-DataRunner-Signature: sha256=<hex> — the HMAC-SHA256 of the raw body. Recompute it on your side before trusting the payload.
- 04Optional: extra headers. A flat JSON object, e.g. an Authorization header. Invalid JSON is dropped silently instead of blocking the save — check this field first if a header never arrives.
- 05Attach it to a report. Report → Destinations → Channel. Treat delivery as at-least-once and dedupe on the run id plus the route.
Fields
| Field | Required | What it is |
|---|---|---|
| URL | Yes | Must be public and reachable over HTTPS. Private addresses are refused by the SSRF guard. (https://api.example.com/hooks/datarunner) |
| HMAC secret (optional) | No | When set, X-DataRunner-Signature carries sha256=<hex> of the raw body. |
| Extra headers JSON | No | Flat JSON object. Invalid JSON is dropped without blocking the save. ({"X-Tenant":"acme"}) |
What goes in Target
Optional. Whatever you type is appended as a path to the configured URL — leave it empty to post to the URL itself.
Target is optional for this channel. — optional extra path
Test
Every channel has a Test button in the channel list (Settings → Channels). The result is kept — date, status and the provider's error when there was one — and a channel that was never tested is marked in the list.
Test POSTs the body {"event":"datarunner.test"} with the configured headers. Your endpoint must answer 2xx; what it does with that event is up to you — ignoring it is fine.
Check it end to end
- 01Report: open a report, add this channel under Destinations (with the Target when the channel needs one), click Run now and open the run. The log says which channel each recipient went through and what the provider answered.
- 02Alert: under Monitoring → Alert routes, create a route with this channel as an escalation step. Routes match on severity and source; the first match wins.
- 03To fire an alert without breaking anything: create an HTTP monitor pointing at a URL that returns an error (for example https://httpstat.us/500) with a short interval. When it goes down the alert leaves through the route; delete the monitor afterwards. The message carries an acknowledge link — click it and the escalation stops.
- 04Report rules (new rows, value out of range) arrive through the same route, with source "report rule".
What most often goes wrong
Private addresses (localhost, 10.x, 192.168.x, *.internal) are blocked as SSRF protection. To reach a service on your machine, expose it through a public tunnel first.