Power up: Webhook CAP Standard

You can choose the format of that message:

Format	What it looks like	When to use it
E3 Standard (default)	Simple JSON	Your receiving system understands E3's own format
CAP Standard	XML, following the Common Alerting Protocol (CAP) v1.2	Your receiving system is an emergency-alert platform (fire panels, mass-notification hubs, government systems) that expects the industry-standard CAP format

 

CAP is an international standard used by emergency alerting systems (e.g. weather alerts, IPAWS) so different systems can understand each other's alerts without custom integration work.

This is one-way, outbound only. E3 sends the message out — it does not receive CAP alerts from anywhere else.

Where you turn it on

Workspace → Integrations → Generic Webhook

1. Enter the URL of the system that should receive the alerts.
2. Choose the format: E3 Standard or CAP Standard.
3. Choose which events should trigger a message (new alert / alert ended).

That's it — one webhook URL, one format, applied to every alert lifecycle event.

How it works (the flow)

1. An alert is created, ended, or its type is changed in E3.
2. E3 checks each account's configured webhook(s).
3. For each webhook set to CAP Standard, E3 builds a CAP XML message and POSTs it to your URL.
4. Your system receives it, parses the standard CAP fields, and does whatever it needs to (display it, forward it, sound an alarm, etc).
5. E3 logs every attempt (success or failure) for troubleshooting.

One quirk: changing an alert's type sends two messages

If an alert's type is changed mid-alert, E3 sends:

• a Cancel message for the old alert type, then
• an Update message for the new alert type (which references the cancelled one)

This keeps any CAP-compliant receiver in sync with exactly what changed.

The CAP message, field by field

Here's a real example of what gets sent when a new alert is created:

<?xml version="1.0" encoding="UTF-8"?>
<alert xmlns="urn:oasis:names:tc:emergency:cap:1.2">
<identifier>e3-alert-123-alert.created</identifier>
<sender>e3-account-1</sender>
<sent>2026-06-24T10:15:30-05:00</sent>
<status>Actual</status>
<msgType>Alert</msgType>
<scope>Private</scope>
<info>
<category>Safety</category>
<event>Fire Drill</event>
<urgency>Immediate</urgency>
<severity>Severe</severity>
<certainty>Observed</certainty>
<senderName>Acme School District</senderName>
<parameter><valueName>alert_id</valueName><value>123</value></parameter>
<parameter><valueName>created_at</valueName><value>2026-06-24T10:15:30-05:00</value></parameter>
<parameter><valueName>account_id</valueName><value>1</value></parameter>
<parameter><valueName>group_id</valueName><value>2</value></parameter>
<parameter><valueName>group_name</valueName><value>Main Campus</value></parameter>
<parameter><valueName>alert_type_id</valueName><value>5</value></parameter>
<parameter><valueName>launched_by_id</valueName><value>10</value></parameter>
<parameter><valueName>launched_by_name</valueName><value>Jane Admin</value></parameter>
<parameter><valueName>is_drill</valueName><value>false</value></parameter>
<parameter><valueName>is_external</valueName><value>false</value></parameter>
</info>
</alert>

 

Field	What it means
identifier	A unique ID for this specific message: e3-alert-{alert id}-{event}
sender	Which E3 account sent it: e3-account-{account id}
sent	The exact time the message was sent
status	Actual for a real alert, Exercise if it's a drill
msgType	What kind of message this is — see table below
scope	Always Private — it's sent directly to your one configured URL, not broadcast publicly
references	Only present on Cancel/Update messages — points back to the original message it's replacing
category	The general kind of hazard (Safety, Fire, Security, etc.) — set per alert type, defaults to Safety
event	The alert type's name (e.g. "Fire Drill", "Lockdown")
urgency	How soon action is needed (Immediate, Expected, Future, Past, Unknown) — defaults to Immediate
severity	How serious it is (Extreme, Severe, Moderate, Minor, Unknown) — defaults to Severe
certainty	How confident E3 is this is really happening (Observed, Likely, Possible, Unlikely, Unknown) — defaults to Observed
senderName	The account's display name
parameter entries	Extra E3-specific details (alert ID, group, who launched it, whether it's a drill, etc.) tucked in as CAP "parameters" so no data is lost, even though CAP itself doesn't have dedicated fields for them

msgType — which E3 event produces which message

What happened in E3	CAP msgType sent
New alert created	Alert
Alert ended	Cancel
Alert type changed → old type	Cancel
Alert type changed → new type	Update

What do category / urgency / severity / certainty mean?

These four values come from the CAP v1.2 standard itself, not from E3. They're set per alert type (currently defaults are used for every alert type — see "Good to know" below).

category — what kind of hazard this is

Value	Meaning
Geo	Geophysical (earthquake, tsunami, volcano)
Met	Meteorological (storm, flood, tornado)
Safety	General safety — E3 default
Security	Public/criminal security (intruder, threat)
Rescue	Rescue / human danger
Fire	Fire
Health	Public health (outbreak, contamination)
Env	Environmental (spill, pollution)
Transport	Transportation (accident, road/transit disruption)
Infra	Infrastructure (power, water, communications)
CBRNE	Chemical, Biological, Radiological, Nuclear, or Explosive
Other	Anything else

urgency — how soon action is needed

Value	Meaning
Immediate	Responsive action should be taken now — E3 default
Expected	Responsive action should be taken soon (within the next hours)
Future	Responsive action should be taken in the future
Past	Referring to an event that already occurred (e.g. a cancellation)
Unknown	Urgency not known

severity — how serious the event is

Value	Meaning
Extreme	Extraordinary threat to life or property
Severe	Significant threat — E3 default
Moderate	Possible threat
Minor	Minimal to no known threat
Unknown	Severity not known

certainty — how confident this is real

Value	Meaning
Observed	Confirmed / already occurring — E3 default
Likely	Likely (>50% probability)
Possible	Possible but not likely (≤50% probability)
Unlikely	Not expected to occur (<~ few % probability)
Unknown	Certainty not known

The E3 Standard format, for comparison

If CAP Standard isn't selected, the same event instead sends plain JSON like this:

{
"event": "alert.created",
"alert": {
"id": 123,
"name": "Fire Drill",
"created_at": "2026-06-24T10:15:30-05:00",
"account": { "id": 1, "name": "Acme School District" },
"group": { "id": 2, "name": "Main Campus" },
"alert_type": { "id": 5, "name": "Fire Drill" },
"launched_by": { "id": 10, "name": "Jane Admin" },
"is_drill": false,
"is_external": false
}
}

 

event will be one of: alert.created, alert.ended, alert.cancelled, alert.updated.

Good to know

The category/urgency/severity/certainty values come from the alert type, not the individual alert. If they're never set, E3 falls back to safe defaults (Safety / Immediate / Severe / Observed) so the