Webhooks available, REST API in development

API and webhooks

Webhooks and the API are available on the Pro plan only.

URMS sends every router event to your systems as a signed webhook today. A REST API for billing and CRM systems is in development.

What's available

Webhooks Available

Set up a webhook channel in your sandbox under Notifications. Choose the event types, minimum severity, clients and quiet hours. Every delivery is signed and logged.

Telegram Available

The same events as readable messages, through your own Telegram bot and chat.

REST API In development

Planned: list routers and their status, run refresh and reboot, change Wi-Fi, and suspend or restore a subscriber's service from your billing system. Endpoints will be documented here when they are live.

Shape it with us

If you run a billing system or CRM and want to integrate early, tell us what you need first.

Webhook format

URMS sends an HTTP POST with a JSON body to your URL. The URL must be public http or https. Redirects are not followed.

X-URMS-EventEvent type, for example offline.

X-URMS-DeliveryEvent ID. Use it to ignore duplicates.

X-URMS-TimestampUnix time of the delivery.

X-URMS-Signaturesha256= followed by the HMAC-SHA256 of timestamp + "." + body, keyed with your channel secret.

# POST https://example.com/hooks/urms
{
  "id": 1042,
  "type": "offline",
  "severity": "crit",
  "occurred_at": "2026-10-17T18:40:00Z",
  "sandbox": "acme",
  "title": "Offline: Main office router",
  "detail": "No check-in for 10 min (last contact 18:30 UTC).",
  "url": "https://app.urms.cloud/t/acme/devices/12",
  "device": {
    "id": 12,
    "label": "Main office router",
    "login": "acme0001",
    "serial": "SN0000000001",
    "client": "Example Client"
  }
}

Verify the signature

Recompute the HMAC over the raw body and compare in constant time. Reject old timestamps to stop replays.

Event types

Type	When
`offline`	A router stopped checking in
`online`	It's back
`rebooted`	Uptime went back to zero
`firmware_changed`	New firmware version reported
`wan_ip_changed`	WAN address changed
`public_ip_changed`	Public address changed
`first_seen`	A new router checked in
`unknown_device`	A login not linked to a device checked in
`flapping`	Connection unstable (repeated drops)
`task_failed`	A command was refused or failed
`test`	You clicked Send test

# Python 3, standard library only
import hmac, hashlib, time

def verify(secret: str, headers, body: bytes) -> bool:
    ts = headers["X-URMS-Timestamp"]
    if abs(time.time() - int(ts)) > 300:
        return False  # too old, possible replay
    mac = hmac.new(secret.encode(),
                   ts.encode() + b"." + body,
                   hashlib.sha256).hexdigest()
    return hmac.compare_digest(
        "sha256=" + mac,
        headers["X-URMS-Signature"])

# Example only: use your own channel secret
secret = "whsec_example_0000000000000000"