Plugin developer guide

Plugin listing webhooks: Slack, Discord and signed JSON

By HOL · Reviewed by Michael Kantor on October 26, 2026

Direct answer

Claim your listing on HOL, open Webhooks in the plugin workspace and paste a Slack or Discord webhook URL or any HTTPS endpoint. HOL sends new followers, reviews, findings, material changes and install milestones for that listing, plus Guard workspace approvals on Gold listings. Listings with Blue or Gold get each event within minutes; others get one digest each Monday. JSON deliveries carry an X-HOL-Webhook-Signature header: v1= and the HMAC-SHA256 of the raw body with your signing secret.

Who this is for

Plugin owners who want listing activity in the channel their team already reads, or in their own tooling.

Good fit

A Slack channel that hears about each new review
A Discord server that celebrates install milestones
An internal service that opens a ticket when a finding appears

Not a fit

Following someone else’s plugin; follow it on HOL or save it for email updates instead

Steps

1.Claim the listing
Only the verified owner of a listing can add webhooks for it. hol-guard plugin links prints the connect link for your repository; open it to verify ownership.
```
hol-guard plugin links .
```
2.Add the webhook
In the plugin workspace, open Webhooks, pick the listing, paste the endpoint and choose events. Slack and Discord incoming webhook URLs get a short message with a link; any other HTTPS URL on port 443 gets signed JSON. Each listing can have five webhooks. Copy the signing secret when it appears: it is shown once.
3.Check the signature
Compute the HMAC-SHA256 of the raw request body with the signing secret, hex encode it, prefix v1= and compare it with X-HOL-Webhook-Signature in constant time. Hash the bytes you received, not a re-serialized object.
```
printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$HOL_WEBHOOK_SECRET" | sed 's/^.*= /v1=/'
```
4.Ignore repeats
X-HOL-Webhook-Id is unique per event and Idempotency-Key per delivery. A failed delivery (anything other than a 2xx within 10 seconds) is retried up to eight times, starting after 30 seconds and backing off to six hours, so store the ID and skip one you have already handled.

Limitations

Events reflect what HOL observed on the listing. A webhook does not change the listing’s trust score, ranking or review results.
Install milestones use the last complete week of attested installs and are sent only once the count is high enough to publish.
Redirects are not followed, and endpoints on private networks are refused.

Questions

Which events can a webhook receive?

New follower (with the follower count), new review (with the rating), new finding, material change, install milestone and, every Monday, the weekly digest for listings without Blue. Gold listings can also receive workspace approvals: the number of Guard workspaces that approved the plugin, sent each time it changes once at least 3 workspaces from 3 accounts have.

Does HOL send who followed or reviewed?

No. Follower events carry only the new count and review events carry the rating and a link to the listing.

Why do I get a weekly digest instead of each event?

Listings without Blue or Gold hold their events and receive them as one digest each Monday. Blue or Gold sends each event within minutes. Apart from Gold’s workspace approvals, the events are the same either way.

Are Slack and Discord messages signed?

The signature header is sent with every delivery, but Slack and Discord do not check it. The incoming webhook URL itself is the secret, so treat it like a password.

Sources

List it on HOL

Connect the repository to verify ownership and claim the listing. New plugins can be submitted for free.

Add a webhook in the plugin workspace