Cloudflare · Schema

Cloudflare Notification Webhook Payload

The standard payload structure for Cloudflare notification webhooks. When an alert fires, Cloudflare sends an HTTP POST with this JSON payload to configured webhook endpoints.

AI GatewayAPI GatewayArtificial IntelligenceCDNCloudContainersDDoS ProtectionDNSEdgeEdge ComputingObject StoragePlatformReal-Time CommunicationSecurityServerlessWeb Performance

Properties

Name	Type	Description
name	string	The name of the notification policy that triggered this webhook.
text	string	Human-readable description of the alert with interpolated values specific to the event.
data	object	Alert-specific data whose structure varies depending on the alert_type. Contains detailed information about the event that triggered the notification.
ts	integer	Unix timestamp in seconds when the notification was generated.
account_id	string	The Cloudflare account identifier associated with the notification. May not be present in all notifications.
policy_id	string	The UUID of the notification policy that triggered the webhook.
policy_name	string	The name of the notification policy.
alert_type	string	The unique identifier for the alert category (e.g., advanced_ddos_attack_l4_alert, health_check_status_notification).
alert_correlation_id	string	UUID for grouping related alerts that are part of the same incident.
alert_event	string	The event state indicating whether the alert is starting or ending.

View JSON Schema on GitHub

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/cloudflare/refs/heads/main/json-schema/cloudflare-notification-webhook-payload-schema.json",
  "title": "Cloudflare Notification Webhook Payload",
  "description": "The standard payload structure for Cloudflare notification webhooks. When an alert fires, Cloudflare sends an HTTP POST with this JSON payload to configured webhook endpoints.",
  "type": "object",
  "required": ["name", "text", "data", "ts"],
  "properties": {
    "name": {
      "type": "string",
      "description": "The name of the notification policy that triggered this webhook."
    },
    "text": {
      "type": "string",
      "description": "Human-readable description of the alert with interpolated values specific to the event."
    },
    "data": {
      "type": "object",
      "description": "Alert-specific data whose structure varies depending on the alert_type. Contains detailed information about the event that triggered the notification."
    },
    "ts": {
      "type": "integer",
      "description": "Unix timestamp in seconds when the notification was generated."
    },
    "account_id": {
      "type": "string",
      "description": "The Cloudflare account identifier associated with the notification. May not be present in all notifications."
    },
    "policy_id": {
      "type": "string",
      "format": "uuid",
      "description": "The UUID of the notification policy that triggered the webhook."
    },
    "policy_name": {
      "type": "string",
      "description": "The name of the notification policy."
    },
    "alert_type": {
      "type": "string",
      "description": "The unique identifier for the alert category (e.g., advanced_ddos_attack_l4_alert, health_check_status_notification).",
      "enum": [
        "advanced_ddos_attack_l4_alert",
        "advanced_ddos_attack_l7_alert",
        "dedicated_ssl_certificate_event_type",
        "health_check_status_notification",
        "workers_alert",
        "workers_observability_alert",
        "access_custom_certificate_expiration_type",
        "zone_aop_custom_certificate_expiration_type",
        "universal_ssl_event_type",
        "clickhouse_alert_fw_anomaly",
        "clickhouse_alert_fw_ent_anomaly",
        "real_origin_monitoring",
        "failing_logpush_job_disabled_alert",
        "expiring_service_token_alert",
        "secondary_dns_all_primaries_failing",
        "secondary_dns_zone_successfully_updated",
        "secondary_dns_zone_validation_warning",
        "sentinel_alert",
        "traffic_anomalies_alert",
        "tunnel_health_event"
      ]
    },
    "alert_correlation_id": {
      "type": "string",
      "format": "uuid",
      "description": "UUID for grouping related alerts that are part of the same incident."
    },
    "alert_event": {
      "type": "string",
      "description": "The event state indicating whether the alert is starting or ending.",
      "enum": ["ALERT_STATE_EVENT_START", "ALERT_STATE_EVENT_END"]
    }
  }
}