---
key: critical-alerts-04-sources-and-incoming-webhooks
title: Add a source and send it a signal
audience: staff
section: critical-alerts
routes: ["/critical-alerts/sources", "/critical-alerts/sources/new"]
permissions: ["critical_alerts.sources.manage"]
features: ["critical_alerts.core"]
since: 0.0.1
updated: 0.0.1
status: published
summary: Create a source, copy its one-time signal address, point a device or outside system at it, and send a test signal to prove the path works.
keywords: [webhook, incoming alarm, device alert, sensor, monitoring system, integration, signal address, token, alarm panel, hook up a device]
related: [critical-alerts-guide, rotate-or-revoke-a-source-address, create-a-critical-alert-rule, create-a-critical-alert-with-guided-setup]
---

In the sidebar, open **Critical Alerts**, then **Setup**, then **Sources**. The page address is `/critical-alerts/sources`.

A source is the door a signal comes in through. For a webhook source, Nova gives you a signal address. A device, alarm panel or monitoring system sends its details to that address, and Nova turns them into a signal for your rules to match.

## Before you start

- Your admin has to give your role permission to manage critical alert sources.
- Have the outside system's settings open. You will paste the address into it, and Nova shows the address only once.

## Steps

1. Press **New source**. The **Create source** drawer opens.
2. Type a **Name**. The **Key** fills in from the name; leave it, because it cannot change after the source is created.
3. Choose the **Source type**: webhook for a device or outside system, email, SMS, or an event inside Nova.
4. Leave **Status** as active and **Auth mode** as **Token**.
5. If the system should check in on a schedule, type **Heartbeat timeout seconds**. Nova can then raise an alert when the check-ins stop.
6. Press **Create source**. Nova opens **Source endpoint & tools** with the new signal address under **POST endpoint**.
7. Press **Copy new POST endpoint** and paste the address into the outside system. Then press **I have stored it**.

> **Warning:** The address contains a secret. Nova shows it once and cannot show it again. If you lose it, issue a new one: see [[rotate-or-revoke-a-source-address]].

## What the outside system sends

The outside system sends a message to the address. Nova reads these details from it, and every one is optional:

- an event name (such as `freezer_high_temp`), which a rule can match on;
- a signal type: `open` when the problem starts, `clear` when it is over, `heartbeat` for a routine check-in;
- a severity: `critical`, `high`, `warning`, `info` or `low`;
- a title and a summary, which become the incident's wording.

Anything else the system includes is kept with the signal, so you can read it later under **Signals**.

## Send a test signal

1. On the source's row, press **Tools**. The **Source endpoint & tools** drawer opens.
2. Under **Manual signal**, check **Source key**, then set **Event name**, **Signal type**, **Severity**, **Title** and **Summary** the way the real device would.
3. Press **Send test signal**. Nova runs the signal through your rules and opens an incident if one matches.

**Human trigger** on the same drawer makes a signed link a person can open to raise the alert by hand. Fill in the same fields, press **Generate human trigger link**, then **Copy** the **Preview URL** or the **Confirm URL**.

## What you see

- Each row shows the source's status, its type, its authentication mode, and the time of its last signal and last heartbeat.
- **Edit** opens the source's settings. **Tools** opens **Source endpoint & tools**.
- The **Filters** button narrows the list by **Status** and **Type**.

## If something looks different

- **New source** is missing: your role cannot manage sources.
- The drawer reads "No active token hint available": this source has never had an address issued. Press **Rotate token** to issue one.
- The outside system reports an error: check that it sends to the address exactly as copied, and that it sends a message rather than simply opening the address. Opening the address in a browser does not work.

[[route:/critical-alerts/sources|Open Sources]]