createWebhookAction()

Summary

Webhook actions send HTTP or HTTPS requests to an external endpoint each time an alert triggers. They let LogScale notify external systems, such as ticketing tools, chat platforms, and incident management services, without manual intervention.

The createWebhookAction() mutation creates a webhook action in a LogScale repository or view. Provide the target URL, HTTP method, request headers, and a template for the message body. On success, the mutation returns a non-null WebhookAction! object. On failure, it returns errors in the GraphQL errors array.

After creating a webhook action, use testWebhookAction() to verify the endpoint receives requests. Modify the action with updateWebhookAction(), or delete it with deleteActionV2(). To organize actions by category or team, assign labels with addActionLabels().

Hide Query Example

Show Webhook Actions Query

To retrieve a list of webhook actions, use the repository() query:

graphql

query {
     repository(name: "humio")
        { id, name,
          actions { id, name,
                    ... on WebhookAction { id, name } }
          }
   }

For more information on webhook actions, see the Action Type: Webhooks documentation page. For an overview of all action types, see Actions.

API Stability	`Long-Term`
Security Requirement and Control	`CreateActions` API permission

Syntax

graphql

createWebhookAction(
      input: CreateWebhookAction!
   ): WebhookAction!

The input argument is required and takes a CreateWebhookAction object. Provide the repository or view name, the target URL, the HTTP method, optional headers, and a body template for the notification payload. The Input Parameters section lists all available fields.

The mutation returns a non-null WebhookAction! object. Request id to retrieve the unique identifier assigned to the new action.

Example

Raw

graphql

mutation {
  createWebhookAction(input:
        { name: "my-webhook-action",
          viewName: "humio",
          url: "https://webhook.company.com",
          method: "POST",
          headers: [ {header: "Content-Type", value: "application/json"} ],
          ignoreSSL: false,
          useProxy: false,
          bodyTemplate: 
             """{"repository": "{repo_name}","timestamp": "{triggered_timestamp}",
                "alert": { "name": "{name}", "query": {"queryString": "{query_string}"} },
                "warnings": "{warnings}", 
                "events": {events}, 
                "numberOfEvents": {event_count} }""",
        } )
  { id }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createWebhookAction(input:
        { name: \"my-webhook-action\",
          viewName: \"humio\",
          url: \"https://webhook.company.com\",
          method: \"POST\",
          headers: [ {header: \"Content-Type\", value: \"application/json\"} ],
          ignoreSSL: false,
          useProxy: false,
          bodyTemplate: 
             \"\"\"{\"repository\": \"{repo_name}\",\"timestamp\": \"{triggered_timestamp}\",
                \"alert\": { \"name\": \"{name}\", \"query\": {\"queryString\": \"{query_string}\"} },
                \"warnings\": \"{warnings}\", 
                \"events\": {events}, 
                \"numberOfEvents\": {event_count} }\"\"\",
        } )
  { id }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createWebhookAction(input:
        { name: \"my-webhook-action\",
          viewName: \"humio\",
          url: \"https://webhook.company.com\",
          method: \"POST\",
          headers: [ {header: \"Content-Type\", value: \"application/json\"} ],
          ignoreSSL: false,
          useProxy: false,
          bodyTemplate: 
             \"\"\"{\"repository\": \"{repo_name}\",\"timestamp\": \"{triggered_timestamp}\",
                \"alert\": { \"name\": \"{name}\", \"query\": {\"queryString\": \"{query_string}\"} },
                \"warnings\": \"{warnings}\", 
                \"events\": {events}, 
                \"numberOfEvents\": {event_count} }\"\"\",
        } )
  { id }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createWebhookAction(input: ^
        { name: \"my-webhook-action\", ^
          viewName: \"humio\", ^
          url: \"https://webhook.company.com\", ^
          method: \"POST\", ^
          headers: [ {header: \"Content-Type\", value: \"application/json\"} ], ^
          ignoreSSL: false, ^
          useProxy: false, ^
          bodyTemplate:  ^
             \"\"\"{\"repository\": \"{repo_name}\",\"timestamp\": \"{triggered_timestamp}\", ^
                \"alert\": { \"name\": \"{name}\", \"query\": {\"queryString\": \"{query_string}\"} }, ^
                \"warnings\": \"{warnings}\",  ^
                \"events\": {events},  ^
                \"numberOfEvents\": {event_count} }\"\"\", ^
        } ) ^
  { id } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createWebhookAction(input:
        { name: \"my-webhook-action\",
          viewName: \"humio\",
          url: \"https://webhook.company.com\",
          method: \"POST\",
          headers: [ {header: \"Content-Type\", value: \"application/json\"} ],
          ignoreSSL: false,
          useProxy: false,
          bodyTemplate: 
             \"\"\"{\"repository\": \"{repo_name}\",\"timestamp\": \"{triggered_timestamp}\",
                \"alert\": { \"name\": \"{name}\", \"query\": {\"queryString\": \"{query_string}\"} },
                \"warnings\": \"{warnings}\", 
                \"events\": {events}, 
                \"numberOfEvents\": {event_count} }\"\"\",
        } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createWebhookAction(input:
        { name: \"my-webhook-action\",
          viewName: \"humio\",
          url: \"https://webhook.company.com\",
          method: \"POST\",
          headers: [ {header: \"Content-Type\", value: \"application/json\"} ],
          ignoreSSL: false,
          useProxy: false,
          bodyTemplate: 
             \"\"\"{\"repository\": \"{repo_name}\",\"timestamp\": \"{triggered_timestamp}\",
                \"alert\": { \"name\": \"{name}\", \"query\": {\"queryString\": \"{query_string}\"} },
                \"warnings\": \"{warnings}\", 
                \"events\": {events}, 
                \"numberOfEvents\": {event_count} }\"\"\",
        } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createWebhookAction(input:
        { name: \"my-webhook-action\",
          viewName: \"humio\",
          url: \"https://webhook.company.com\",
          method: \"POST\",
          headers: [ {header: \"Content-Type\", value: \"application/json\"} ],
          ignoreSSL: false,
          useProxy: false,
          bodyTemplate: 
             \"\"\"{\"repository\": \"{repo_name}\",\"timestamp\": \"{triggered_timestamp}\",
                \"alert\": { \"name\": \"{name}\", \"query\": {\"queryString\": \"{query_string}\"} },
                \"warnings\": \"{warnings}\", 
                \"events\": {events}, 
                \"numberOfEvents\": {event_count} }\"\"\",
        } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createWebhookAction(input:
        { name: \"my-webhook-action\",
          viewName: \"humio\",
          url: \"https://webhook.company.com\",
          method: \"POST\",
          headers: [ {header: \"Content-Type\", value: \"application/json\"} ],
          ignoreSSL: false,
          useProxy: false,
          bodyTemplate: 
             \"\"\"{\"repository\": \"{repo_name}\",\"timestamp\": \"{triggered_timestamp}\",
                \"alert\": { \"name\": \"{name}\", \"query\": {\"queryString\": \"{query_string}\"} },
                \"warnings\": \"{warnings}\", 
                \"events\": {events}, 
                \"numberOfEvents\": {event_count} }\"\"\",
        } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "createWebhookAction": {
      "id": "abc123"
    }
  }
}

Input Parameters

The input argument takes a CreateWebhookAction object. Provide the repository or view name, the target URL, the HTTP method, and a body template. Include headers for authentication or content negotiation. Set ignoreSSL and useProxy to control TLS verification and proxy routing.

Table: CreateWebhookAction Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 14, 2026
bodyTemplate	String	yes	`Long-Term`	Body of the http(s) request. Can be templated with values from the result.
headers	HttpHeaderEntryInput	yes	`Long-Term`	Headers of the http(s) request. See HttpHeaderEntryInput.
ignoreSSL	Boolean	yes	`Long-Term`	Flag indicating whether SSL should be ignored for the request.
labels	String	yes		Labels to categorize the action.
method	String	yes	`Long-Term`	The method to use for the request.
name	String	yes	`Long-Term`	Name of the action.
url	String	yes	`Long-Term`	The URL where to send the http(s) request.
useProxy	Boolean	yes	`Long-Term`	Defines whether the action should use the configured proxy to make web requests.
viewName	String	yes	`Long-Term`	Name of the view of the action.

Returned Values

The mutation returns a WebhookAction! object for the newly created action. Request id to retrieve the unique identifier. The returned fields also include the target URL, HTTP headers, body template, a YAML representation for export, and creation and modification metadata.

Table: WebhookAction Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 17, 2025
allowedActions	[AssetAction]	yes	`Short-Term`	A list of allowed asset actions. See AssetAction. This is a preview and subject to change.
bodyTemplate	string	yes	`Long-Term`	Body of the http and https request. Can be templated with values from the result.
createdInfo	AssetCommitMetadata		`Long-Term`	Metadata related to the creation of the action. See AssetCommitMetadata.
displayName	string	yes	`Long-Term`	The display name of the action.
headers	[HttpHeaderEntry]	yes	`Long-Term`	Headers of the http and https requests. See HttpHeaderEntry.
id	string	yes	`Long-Term`	The unique identifier of the action.
ignoreSSL	boolean	yes	`Long-Term`	Whether SSL should be ignored for the request.
isAllowedToRun	boolean	yes	`Long-Term`	Set to false to disable this type of action for security reasons.
labels	[string]	yes	`Preview`	Labels associated with the action.
method	string	yes	`Long-Term`	Method to use for the request.
modifiedInfo	AssetCommitMetadata		`Long-Term`	Metadata related to the latest modification of the action. See AssetCommitMetadata.
name	string	yes	`Long-Term`	The name of the action.
package	PackageInstallation	yes	`Long-Term`	The package, if there is one, of which the action is part. See PackageInstallation.
packageId	VersionedPackageSpecifier		`Long-Term`	The unique identifier of the package. VersionedPackageSpecifier is a scalar.
requiresOrganizationOwnedQueriesPermissionToEdit	boolean	yes	`Long-Term`	This should be set to true if this action is used by triggers, where the query is run by the organization. If true, then the OrganizationOwnedQueries permission is required to edit the action. See Permission.
resource	string	yes	`Short-Term`	The resource identifier for the action.
url	string	yes	`Long-Term`	The URL where to send http and https requests.
useProxy	boolean	yes	`Long-Term`	Whether the action should use the configured proxy to make web requests.
yamlTemplate	YAML	yes	`Long-Term`	A template that can be used to recreate the action. YAML is a scalar.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes