Setting up webhook notifications

Webhook notifications deliver Krisp alerts to an external endpoint, so your team can act on them in the tools they already work in. You can send alerts to a SIEM platform for security monitoring, or to a Microsoft Teams channel for day-to-day visibility, without giving anyone access to the Admin Portal.

You can configure multiple endpoints, each with its own event selection and delivery history.

Where to find webhook settings

To find the relevant settings for webhooks:

• Open the Admin Portal
• Go to Integrations >>> Webhook.

Create a webhook endpoint

1. Click Create new integration.
2. Under Webhook details, enter a Name that will help you recognize this endpoint later, and an optional Description.
3. Under Team scope, select the teams whose events are sent to this endpoint. Select All teams to include every team within your Organization, or pick individual teams.
4. Under Endpoint, select the Integration type and enter the Endpoint URL.
5. Under Events, select the events you want delivered to this endpoint.
6. Click Create.

For SIEM endpoints, a secret key is generated as soon as you click Create, and it is shown to you only once. See Secret key before you create the endpoint.

Endpoint types

Events

Select the events you want sent to this endpoint. Each endpoint has its own selection, so you can send security events to a SIEM platform and operational events to a Teams channel.

Secret key

SIEM endpoints are signed with a secret key, which lets your receiving service confirm that each request came from Krisp and was not altered in transit. Teams endpoints do not use a secret key.

The key is generated automatically when you click Create. A modal opens with the key and a copy button. Copy the key and store it in your secret manager before closing the modal: Krisp does not show it again.

Once the modal is closed, the Secret key field appears in the endpoint settings with the value masked, next to a Regenerate option. Use Regenerate if the key is lost or needs to be rotated. The new key is shown in a modal, in the same way as the original.

For the signature format and reference verification code, see Webhook signature verification.

Test the endpoint

Open an existing endpoint and click Test next to the Endpoint URL field. Krisp sends a test alert to the URL, using the same format and, for SIEM endpoints, the same signature as a real event. The test alert is recorded in the endpoint's history, so you can confirm whether it was delivered.

Use the test whenever you add an endpoint, change its URL, or regenerate its secret key.

Manage your endpoints

All your endpoints are listed on the Webhook page, with their state, integration type, team scope, and description.

• To pause or resume deliveries, use the toggle in the State column, or the Webhook is active toggle inside the endpoint. A paused endpoint keeps its configuration and its secret key.
• To change an endpoint, open it from the list, edit any field on the Details tab, and click Save.
• To remove an endpoint permanently, open it and click Delete.

Delivery history

Open an endpoint and select the History tab to see its recent delivery attempts. Each row shows the date, the alert, the event ID, and the state:

• Sent: Krisp delivered the event to your endpoint
• Failed: the endpoint did not accept the event.

History is kept for 7 days. If you see failed attempts, confirm that the endpoint URL is still correct and reachable, and use Test to check the connection after you fix it.

Event payload

Krisp sends each event to SIEM endpoints as a JSON request. Every event uses the same envelope:

• event_type: the type of event
• event_id: the unique identifier of the event
• timestamp: when the event was generated, in UTC
• payload: the details of the event, including the team it came from.

The test alert looks like this:

{
  "event_type": "test_alert",
  "event_id": "958d63d7-f1a3-49a7-a6a4-ec4d669be88c",
  "timestamp": "2026-09-19T09:46:10.831Z",
  "payload": {
    "test": true,
    "team_id": 7561873,
    "user_id": 13010529,
    "team_name": "Krisp"
  }
}

Other events follow the same structure, with the details of the event in the payload object.