Alerts and webhooks

Email alerts

Email alerts are off by default. Turn them on per project under Email alerts on the Settings tab.

After each scan, one email goes to every member of the project's organization with the new mentions that need action:

• urgency High, or
• type Misinformation, or
• type Buying intent, or
• a lead with active intent and fit of 80 or more (or your minimum fit, if it's higher). Older assessments without separate intent keep their previous alert rule.

Mentions judged unrelated never trigger an alert. If a scan finds nothing that needs action, no email is sent.

Each mention in the email shows its type, the author, the source, the start of the text and a link to the post. The email ends with links to all mentions and to turn alerts off.

Webhook

Add a Webhook URL on the Settings tab to receive a POST request for every new mention. Leave the field empty and save to turn it off.

• The URL must be a public https address. A query string, for example a token, is allowed.
• The first time you save a URL, Overhear creates a signing secret (whsec_…) and shows it under the field. Changing the URL keeps the secret. Turning the webhook off deletes it.
• Mentions judged unrelated are not sent.
• Leads arrive as lead.created, only at or above the project's minimum fit, with fit (customer suitability, 0–100), fit_reason, intent, and evidence. These fields are null for brand mentions; older lead assessments have no separate intent or evidence. Zero-fit results are excluded.
• Deliveries happen after classification, so they include the type and urgency.

Payload

Each delivery is a JSON body with the event type mention.created:

{
  "type": "mention.created",
  "timestamp": "2026-10-17T09:15:42.191921+00:00",
  "data": {
    "id": "6b7390bd-393c-4866-bacc-613021ea866c",
    "project": { "id": "…", "name": "Stepshots" },
    "keyword": "stepshots",
    "source": "x",
    "url": "https://x.com/…",
    "author": "coindotgo",
    "title": null,
    "text": "What tech stack do you use to ship so many tools?",
    "posted_at": "2026-10-12T08:01:00Z",
    "found_at": "2026-10-17T09:00:12Z",
    "engagement": 1,
    "category": "question",
    "category_label": "Question",
    "sentiment": "positive",
    "urgency": "medium",
    "fit": null,
    "fit_reason": null,
    "intent": null,
    "evidence": null
  }
}

• source is one of x, reddit, linkedin, youtube, web.
• category is lead, complaint, bug, question, praise, misinformation, other, or the id of one of your own categories. category_label is the name shown in the app.
• sentiment is positive, neutral or negative. urgency is high, medium or low.
• category, category_label, sentiment and urgency are null when the mention couldn't be classified.

Verifying the signature

Deliveries are signed the Standard Webhooks way, so you can verify them with any of its libraries. Each request carries three headers:

Header	Value
webhook-id	msg_ plus the mention id. It stays the same on retries, so use it to skip duplicates.
webhook-timestamp	Unix seconds when the request was signed.
webhook-signature	v1, plus the base64 HMAC-SHA256 of {webhook-id}.{webhook-timestamp}.{body}, keyed with the base64-decoded part of the secret after whsec_.

Retries

Any response outside 2xx, or no response within 10 seconds, counts as a failure. A failed delivery is retried with increasing delays, up to 5 attempts in total.