Webhooks

Project webhooks send a signed HTTP POST request whenever an issue changes state. They are separate from both Slack alerts and Lemma MCP. Open the project’s Settings → Webhooks in the Lemma dashboard to configure one. Lemma doesn’t emit incident.* events. Customer alerting follows issues instead. If you find incident-named events in older samples or docs, they’re stale.

Events

Event	When it fires
`issue.created`	A new issue was created
`issue.resolved`	The issue was marked resolved
`issue.dismissed`	The issue was dismissed
`issue.reopened`	A resolved issue reopened from matching evidence. Dismissed issues never reopen this way.

Set up an endpoint

Add an HTTPS endpoint

Open the project’s Settings → Webhooks, add an HTTPS endpoint, and select the issue events you want.

Save your signing secret

Copy the signing secret when Lemma shows it. It won’t be shown again, and regenerating it replaces the old value, so store it in your receiver’s secret manager immediately.

Verify signature and timestamp

Every request includes an X-Lemma-Signature header containing sha256=<hex> and an X-Lemma-Timestamp header with the Unix delivery time in seconds. Verify the signature against the raw request body, then check the timestamp is recent, before you process anything. A 5-minute tolerance (the convention Stripe and GitHub also use) absorbs normal delivery and retry delay while still rejecting a replayed request.The signature is a Hash-based Message Authentication Code (HMAC) with SHA-256 over the exact raw body.

Node.js
Python

import { createHmac, timingSafeEqual } from "crypto";

const TOLERANCE_SECONDS = 5 * 60;

function verifyLemmaSignature(
  rawBody: string,
  secret: string,
  signature: string,
  timestamp: string,
): boolean {
  const expected =
    "sha256=" +
    createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  const signatureValid =
    a.length === b.length && timingSafeEqual(a, b);

  const ageSeconds = Math.abs(Date.now() / 1000 - Number(timestamp));
  const timestampFresh =
    Number.isFinite(ageSeconds) && ageSeconds <= TOLERANCE_SECONDS;

  return signatureValid && timestampFresh;
}

import hmac, hashlib, time

TOLERANCE_SECONDS = 5 * 60

def verify_lemma_signature(
    raw_body: bytes, secret: str, signature: str, timestamp: str
) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    signature_valid = hmac.compare_digest(expected, signature)

    try:
        age_seconds = abs(time.time() - float(timestamp))
        timestamp_fresh = age_seconds <= TOLERANCE_SECONDS
    except ValueError:
        timestamp_fresh = False

    return signature_valid and timestamp_fresh

Always verify against the raw request body. Parsing and re-serializing the JSON changes whitespace and breaks the signature check.

Test delivery

Send a test event, confirm your endpoint returns 2xx, and leave it enabled.

Headers and verification

Every request carries three headers you’ll use to verify and route it:

X-Lemma-Signature: the sha256=<hex> HMAC-SHA256 of the raw body
X-Lemma-Timestamp: Unix seconds; reject requests older than your tolerance to block replays
X-Lemma-Event: the event type; route on this header

Payload shape

The envelope always includes event, timestamp, projectId, and an issue object with the issue’s ID, status, and related fields. Don’t expect an incident object; that shape doesn’t exist anymore.

{
  "event": "issue.created",
  "timestamp": "2026-08-28T12:00:00.000Z",
  "projectId": "39e9c46a-...",
  "issue": {
    "id": "abc123",
    "status": "open"
  }
}

Delivery and retries

Lemma counts a 2xx response within 10 seconds as a successful delivery and retries failures with exponential backoff. You can review delivery history, status, and latency (not signing secrets) in Settings → Webhooks → Delivery log. Offload slow processing to a background job so you can return 2xx immediately.

Security checklist

Verify X-Lemma-Signature and reject stale X-Lemma-Timestamp values (a 5-minute tolerance works well) on every request
Route on X-Lemma-Event
Use HTTPS endpoints only
Store the signing secret in an environment variable, never in source control
Remember this is distinct from Slack alerts and from Linear’s inbound webhooks to Lemma

Issues

The lifecycle these events report.

Slack

Human-readable issue alerts in Slack instead of HTTP.

Connect your workflow

When to use webhooks versus Slack, Linear, or MCP.

Getting Started

Platform

Connections

Events

Set up an endpoint

Headers and verification

Payload shape

Delivery and retries

Security checklist

Issues

Slack

Connect your workflow

​Events

​Set up an endpoint

​Headers and verification

​Payload shape

​Delivery and retries

​Security checklist

​Related pages

Issues

Slack

Connect your workflow

Events

Set up an endpoint

Headers and verification

Payload shape

Delivery and retries

Security checklist

Related pages