Webhooks

Add an https endpoint under Developer. We POST to it as soon as a mention has been classified — no polling required.

Events

• mention.created — a new mention passed classification and was judged relevant.

Payload

{
  "event": "mention.created",
  "created_at": "2026-09-01T09:20:11.412Z",
  "data": {
    "id": "7b0f1e3a-1c4d-4a0a-9f2b-2f4a8c1d0e11",
    "source": "reddit",
    "url": "https://reddit.com/r/SaaS/comments/abc123",
    "author_handle": "ops_kate",
    "text": "Our analytics bill tripled…",
    "category": "complaint",
    "sentiment": "negative",
    "urgency": 72,
    "ai_summary": "User is priced out of a competitor and asking for alternatives."
  }
}

Verifying the signature

Each delivery carries x-herculeradar-signature in the form t=1756713611,v1=…. Recompute HMAC-SHA256 over the timestamp, a dot and the raw request body, using your endpoint secret, and compare in constant time. Reject anything older than five minutes.

import crypto from "node:crypto";

export function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(",").map((part) => part.split("=")),
  );

  const expected = crypto
    .createHmac("sha256", secret)
    .update(parts.t + "." + rawBody)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(parts.v1),
    Buffer.from(expected),
  );
}

Delivery

• Respond with any 2xx within ten seconds.
• Every attempt is recorded with its response code and is visible in the dashboard.
• Alert rules can also target a webhook URL, if you want filtering applied first.