Event webhooks for automation

Pro plan and above

Event webhooks send a JSON request to a URL of yours whenever something happens in NexoVirt: a server is created or deleted, a plan is suspended, an alert fires, and so on. Use them to drive your own automation, billing sync or chat notifications.

Not the same as alert webhooks

This is the general event webhook system (one lifecycle event to your URL, with a body you design). The Discord, Google Chat and generic webhooks under Alerts are an alert delivery channel with fixed formats. Both can be used at the same time.

Events

Group	Events
Server	Server created, Server reinstalled, Server password reset, Server deleted, Server power action
Plan	Plan suspended, Plan deleted, Plan resumed, Plan expiry warning
Account	Welcome email, Password reset
Alerts	Alert fired, Alert resolved

Creating a hook

Open Settings → Event webhooks and choose New hook. Each hook listens to one event:

• Name and Event.
• URL (http or https) and Method (POST or PUT).
• Headers: optional custom headers, for example an API key for your endpoint.
• Secret: after the first save, Generate secret creates a signing secret. It is shown once.
• Enabled.
• Body (JSON): the request body, with {Variable} placeholders. Click a variable chip to insert it. {Event} and {Timestamp} are always available; the others depend on the event (for example {GuestName}, {Vmid}, {Ipv4}, {PlanName}, {AlertTitle}, {Severity}).

{
  "event": "{Event}",
  "guest": "{GuestName}",
  "vmid": "{Vmid}",
  "ip": "{Ipv4}"
}

The Preview pane renders the body with sample data as you type, and the body must be valid JSON to save. Test send makes one real request with sample data and shows the HTTP status and response.

Sensitive variables

Some events offer variables such as {SshPassword}. Only use them with endpoints you trust and over https. Once a delivery is finished, password, secret and token values are removed from the stored copy.

Request format

Every delivery is sent with these headers (custom headers cannot override them):

Header	Value
Content-Type	application/json
X-Nexo-Event	The event key, for example server_created
X-Nexo-Delivery	The delivery id (0 for a test send)
X-Nexo-Hook	The hook id
X-Nexo-Signature	sha256=<hex>, only when a secret is set

The signature is the HMAC-SHA256 of the exact raw request body, keyed with the hook’s secret. Verify it on your endpoint before trusting a payload:

import hmac, hashlib

def is_valid(secret: str, raw_body: bytes, header: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)

Delivery and retries

Deliveries are queued and sent every minute by hooks:flush. Any 2xx response counts as sent. A failed attempt is retried after 1, 5, 15 and 30 minutes; after the fifth failed attempt the delivery is marked failed. Requests time out after 10 seconds.

The Deliveries tab lists every delivery with its event, hook, status (pending, sent, failed) and HTTP code. Open one to see the body, attempts and last error, and retry a failed delivery from there. Finished deliveries are kept for 30 days (hooks.retention_days).

Secrets at rest

A hook’s secret and custom headers are stored encrypted. Deleting a hook also deletes its delivery history. Every create, change, delete, test, retry and secret regeneration is written to the audit log.

Alerts & webhooksAlert delivery to inbox, email, Discord and Google Chat.

Automation (REST API)Drive NexoVirt from your own tools.