Slack, Teams and webhooks
Besides email, events can land where the team actually looks: a Slack channel, a Microsoft Teams channel, or your own system through a signed webhook. They are configured from Account area › Alerts and are an administrator action.
The channels
| Channel | What it needs | Format |
|---|---|---|
| Slack | An incoming webhook for the workspace. | A message with a bold title, the text and a link to the case. |
| Microsoft Teams | An incoming webhook connector on the channel. | A card with title, text and link. |
| Generic webhook | An HTTPS endpoint of yours. | JSON with event, title, text, link, HMAC-signed. |
Which events to send
Events are enabled individually: new report, triage outcome, deadline approaching. Enable only what requires action — a channel that pings for everything stops being read within a week.
Good practice. A dedicated channel (say #cra-notify) carrying only new reports and deadlines, and none of the informational events. Whoever watches the deadlines must be able to tell at a glance what is urgent.
The signed webhook
The generic webhook sends a JSON POST with the header:
X-CRA-Signature: sha256=<HMAC-SHA256 of the body, in hex>The secret is generated for your organisation and is visible on the alerts screen. The receiver must:
- read the raw body, before any deserialisation;
- compute the HMAC-SHA256 with the shared secret;
- compare it with the header using a constant-time comparison;
- reject the request if they do not match.
// example in Go
mac := hmac.New(sha256.New, []byte(secret))
mac.Write(rawBody)
want := "sha256=" + hex.EncodeToString(mac.Sum(nil))
if !hmac.Equal([]byte(want), []byte(r.Header.Get("X-CRA-Signature"))) {
http.Error(w, "invalid signature", http.StatusUnauthorized)
return
}Without signature verification your endpoint accepts any message from anyone who knows its address. If the secret has been exposed, regenerate it on the alerts screen and update the receiver.
Test message
The screen sends a test message to every active channel and records each outcome in the activity registry («ok» or the error returned). It is the quick way to tell a wrong address from a connector disabled by the workspace from a network problem.
Limits and behaviour
- Each dispatch has a short timeout: a slow channel does not slow down the workflow.
- A channel answering with an error is recorded as failed, but it does not block the other channels or the email.
- These channels are a convenient duplicate, not the evidential channel: evidence remains the registry and the operational email.
What is sent
The message carries the event title, a few descriptive lines (product and case identifier) and the link to the case. It does not carry the full text of the report or the attachments: someone without access to the application learns nothing confidential from the chat channel alone.