Notifications

SubImage can alert you when an integration sync fails or needs attention, and send periodic findings summaries. You choose where those alerts go: email, Slack, or an outbound webhook.

Each channel has its own on/off toggle and its own "Send test" button. Changes save automatically as you make them; there is no separate save step.

Channels

Email

Add one or more recipient email addresses. SubImage sends a formatted message (subject lines encode severity, for example "[Critical] AWS Sync Failed"). Use "Send test" to confirm delivery to the first recipient.

Slack

Slack notifications require the SubImage Slack app to be connected first. Install it from the Integrations settings page, then return here. The card header shows the connected workspace.

Add the channels you want alerts in, either by name (#alerts) or by channel ID (C123ABC456). For private channels, invite the SubImage bot to the channel, otherwise delivery fails with a "not in channel" error.

Webhook

Set a single HTTPS URL. SubImage sends an HTTP POST with a JSON body on each event. The payload always includes event_type, severity, tenant_id, and timestamp, plus event-specific fields, for example:

{
  "event_type": "sync.failed",
  "severity": "critical",
  "tenant_id": "acme",
  "module_name": "aws",
  "sync_id": "...",
  "error_message": "...",
  "timestamp": "..."
}

URLs that resolve to private, loopback, or internal addresses are rejected for security. Payloads are not signed, so verify the source by other means (for example a secret path or an allowlist on your receiver).

What triggers a notification

Every enabled channel receives all of the events below. You cannot route a specific event to a specific channel: a channel is either on (and gets everything) or off.

• Sync failed: an integration sync ran but failed completely. Severity critical.
• Sync partially failed: some accounts or projects in a sync failed while others succeeded. Severity warning.
• Integration needs attention: a customer-fixable problem such as an expired token or missing permission. The message includes the specific error and how to fix it.
• Findings enabled: a one-time notice the first time findings are available, with a link to the dashboard.
• Weekly findings summary: a digest of new findings and findings still open after seven days, sent Monday at 09:00 UTC.

To avoid noise, repeated sync alerts for the same integration are rate-limited (about once per day per integration). The one-time and weekly notices each fire only on their own schedule.