Nexthink Webhooks Skill

Nexthink (digital employee experience) can push an HTTP request to your server when an alert or event matches a webhook's NQL condition. Webhooks are not signed. The only authentication is the Authorization header built from the connector credential you attach to the webhook. The method (POST, PUT or PATCH) and the JSON body are whatever you configure.

When to Use This Skill

• How do I receive Nexthink webhooks?
• How do I verify the Authorization: Bearer <token> header from a Nexthink webhook?
• Does Nexthink sign webhook payloads? (No: shared credential header only)
• Why does my Nexthink webhook endpoint return 401?
• How do I handle the {{alert.monitor.name}} template payload Nexthink sends?

Verification (core)

Create a Bearer token connector credential and attach it to the webhook. Nexthink sends Authorization: <Header prefix> <Token>, usually Authorization: Bearer <token>. Set NEXTHINK_AUTHORIZATION to the whole header value, scheme prefix included, and compare the whole Authorization header to it. Don't strip, parse or base64-decode the prefix:

const crypto = require('crypto');

// Hash both sides: equal-length buffers, so timingSafeEqual never throws.
function safeEqual(a, b) {
  const ha = crypto.createHash('sha256').update(String(a)).digest();
  const hb = crypto.createHash('sha256').update(String(b)).digest();
  return crypto.timingSafeEqual(ha, hb);
}

function verifyNexthinkRequest(headers, expected = process.env.NEXTHINK_AUTHORIZATION) {
  if (!expected) return false;                // never accept when unconfigured
  const received = headers['authorization'];  // full value, e.g. "Bearer abc123"
  return Boolean(received) && safeEqual(received, expected);
}

Return 401 when this fails, 400 for a non-empty body that isn't valid JSON, and 200 once handled. Read the body raw (express.raw({ type: '*/*' })) and parse it only after the check. Accept POST, PUT and PATCH (the webhook Method dropdown) and handle an empty body. Python and Next.js equivalents are in references/verification.md.

A static shared credential authenticates the sender, not the body, and gives no replay protection (no signature, no timestamp). Use HTTPS and rotate the credential if it leaks.

For complete handlers with tests, see examples/express/, examples/nextjs/, examples/fastapi/.

Payload and Events

Nexthink adds no event field. The body is the JSON Payload template you write on the webhook, with {{variable}} placeholders from the NQL data model (for example {{alert.monitor.name}}), so you decide the shape. The examples use this clearly illustrative template, with event a field you chose and not something Nexthink sends:

{ "event": "alert triggered", "monitor": "{{alert.monitor.name}}" }

The examples dispatch on event values alert triggered and alert recovered; see references/overview.md.

Setup Note (same as in Hookdeck)

Choose the Bearer token credential type for the webhook and paste the whole Authorization value here, including "Bearer ". Basic and OAuth credentials are not covered by Hookdeck's Nexthink source (NEXTHINK).

The request method is user-chosen. Hookdeck's Nexthink source pre-selects POST without managing the method, so if the webhook uses PUT or PATCH, allow that method on the source too. See references/setup.md.

Environment Variables

NEXTHINK_AUTHORIZATION=Bearer your-connector-credential-token   # full header value

Local Development

npx hookdeck-cli listen 3000 nexthink --path /webhooks/nexthink

No account required. Use the printed URL as the credential's URL (and the webhook's Resource for the path).

Resources

• references/overview.md - Webhooks, methods, payload templates, illustrative events
• references/setup.md - Connector credential and webhook configuration in Nexthink
• references/verification.md - Header check in Node, Python and Next.js, gotchas
• examples/ - Runnable Express, Next.js and FastAPI handlers with tests