Cloudflare notification webhook payload example

Cloudflare · event: health_check_status_notification · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

Headers

content-type: application/json
cf-webhook-auth: hookden-cloudflare-sample-webhook-secret

Body

{
  "name": "Origin health alert",
  "text": "Health check origin-api-prod changed status from healthy to unhealthy: TCP connection failed.",
  "data": {
    "account_name": "Acme Corp",
    "account_tag": "9035f53656c247e895c5a6939ae8a0e0",
    "health_check_id": "ac9d0a54c8f34b6c8e63c09e8d952b27",
    "health_check_name": "origin-api-prod",
    "new_health_status": "unhealthy",
    "new_status": "critical",
    "old_status": "ok",
    "origin_ip": "203.0.113.10",
    "reason": "TCP connection failed",
    "status_change_time": "2026-08-30T11:21:57Z",
    "time_since_last_failure": "72h14m",
    "zone_name": "acme.example",
    "zone_tag": "023e105f4ecef8ad9ca31a8372d0c353"
  },
  "ts": 1788520917,
  "account_id": "9035f53656c247e895c5a6939ae8a0e0",
  "policy_id": "749b911ea5d04344a58e45edd099b328",
  "policy_name": "Origin health alert",
  "alert_type": "health_check_status_notification",
  "alert_correlation_id": "000eaa907ed24e78946d3a93adb2ae57",
  "alert_event": "ALERT_STATE_EVENT_START"
}

Things that bite people

• No signature — the secret itself travels in a header. If you set a secret on the webhook destination, Cloudflare sends it verbatim in cf-webhook-auth on every request; the documented check is "reject if the header is missing or doesn't match". That means the header value is the credential: anyone who can read your request logs (or a capture you share) can forge notifications. Treat it accordingly — and note there's no timestamp binding, so there's no replay protection either.
• Generic webhooks need a Pro-plan zone. The feature is only available if the account has at least one zone on Pro or above. Notifications go out from Cloudflare's published IP ranges — if your endpoint sits behind a firewall, allowlist those (they're shared across CF services and change; re-check periodically).
• Delivery only reaches a publicly resolvable IP on port 80 or 443. Private IPs, localhost, and custom ports silently never receive anything — Cloudflare's docs suggest a Worker forward or a Tunnel; a capture bin + relay to localhost does it with zero infrastructure.
• Save and Test fires a hello-world first. Creating the destination sends {"text": "Hello World! This is a test message…"} — just the text field, none of the rest of the schema. If your handler requires alert_type, the verification test itself fails and the destination won't save. Accept minimal payloads.
• The envelope is stable, data is not. Every real notification carries name/text/data/ts (unix seconds) plus policy metadata; data's shape changes per alert_type (DDoS L4/L7, cert expiry, health checks…), and account_id/policy_id/alert_type may be absent on some types. alert_event distinguishes ALERT_STATE_EVENT_START from …_END — pair them via alert_correlation_id to auto-resolve incidents.
• You can't edit a webhook's URL or secret — only its name. Rotating the secret or moving the endpoint means delete + recreate + re-attach to every notification policy. Point policies at a capture bin first to see real alert payloads for your alert_type before wiring the permanent handler (webhook deliveries have no documented retry schedule — assume at-most-once).

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'cf-webhook-auth: hookden-cloudflare-sample-webhook-secret' \
 -d '{
  "name": "Origin health alert",
  "text": "Health check origin-api-prod changed status from healthy to unhealthy: TCP connection failed.",
  "data": {
    "account_name": "Acme Corp",
    "account_tag": "9035f53656c247e895c5a6939ae8a0e0",
    "health_check_id": "ac9d0a54c8f34b6c8e63c09e8d952b27",
    "health_check_name": "origin-api-prod",
    "new_health_status": "unhealthy",
    "new_status": "critical",
    "old_status": "ok",
    "origin_ip": "203.0.113.10",
    "reason": "TCP connection failed",
    "status_change_time": "2026-08-30T11:21:57Z",
    "time_since_last_failure": "72h14m",
    "zone_name": "acme.example",
    "zone_tag": "023e105f4ecef8ad9ca31a8372d0c353"
  },
  "ts": 1788520917,
  "account_id": "9035f53656c247e895c5a6939ae8a0e0",
  "policy_id": "749b911ea5d04344a58e45edd099b328",
  "policy_name": "Origin health alert",
  "alert_type": "health_check_status_notification",
  "alert_correlation_id": "000eaa907ed24e78946d3a93adb2ae57",
  "alert_event": "ALERT_STATE_EVENT_START"
}'

← All payload examples · Signature debugger · Docs