Receive instant alerts when an employee clicks on a phishing link or enters credentials, without needing to log into the platform.
Integrate Whalemate with your SIEM, security platform, LMS, or internal communication tools like Slack or Microsoft Teams.
Keep external dashboards updated with campaign results in real time.
Automate responses to awareness incidents without manual intervention.
Eliminate the need to periodically query the API: Whalemate sends the data to your system when it occurs.
Navigation: Settings → Integrations → Webhooks card → Configure
Create a webhook:
Click on New Webhook.
Fill in the Webhook name and the Endpoint URL (must start with https://).
Under Events to subscribe to, choose one or more of the five available events (Sent, Opened, Clicked, Credentials captured, Reported), or use Select all.
Click on Save Webhook.
The HMAC secret is shown only once when saving. Copy it and save it: it cannot be recovered afterward. Your system needs it to validate that notifications come from Whalemate.
Manage a webhook:
Edit: modify the name, URL, or subscribed events. From there you can also Rotate secret (immediately invalidates the previous one) or Delete the webhook.
Test: sends a test payload and shows the result on the same screen — success (HTTP 200 · {ms} ms), HTTP error (HTTP {code} · {ms} ms), or "No response" on timeout or connection error.
Disable / Enable: pause or resume notifications.
⚠️ If an endpoint accumulates 20 consecutive failures, Whalemate automatically disables it (red "Disabled" badge + number of failures). Clicking Enable resumes deliveries without prior verification and resets the failure counter to zero. We recommend using Test before reactivating to confirm that the endpoint responds with 2xx.
Automatic retries
If your server does not respond with a 2xx code or exceeds the time limit, Whalemate automatically retries with the following schedule:
Attempt | Wait |
|---|---|
1 (original send) | — |
2 | 1 minute |
3 | 5 minutes |
4 | 30 minutes |
5 (last) | 2 hours |
After attempt 5, the delivery remains in failed status
If your endpoint accumulates 20 consecutive failures, Whalemate automatically disables it. To reactivate it, resolve the issue on your server and contact us.
Can I receive the same event more than once?
Yes, in exceptional network cases Whalemate may deliver the same event twice. To avoid processing it as a duplicate, use the X-Whalemate-Delivery-Id field as an idempotency key in your system.
What happens to events that occurred while my endpoint was disabled?
They are not automatically backfilled. If you need that data, you can retrieve it through the Whalemate REST API.
Why was my endpoint disabled?
Whalemate automatically disables endpoints that accumulate 20 consecutive failed deliveries. When reactivating it with Enable, deliveries resume without prior verification (the failure counter is reset). If the endpoint is still down, it will accumulate failures again and be disabled once more at 20. We recommend using Test before reactivating to confirm it responds with 2xx.
Do you have feedback or want to request improvements? Let us know at roadmap.whalemate.com/roadmap
