Polling an API on a timer to check whether a website changed its tech stack is wasteful. You burn requests checking domains that have not changed, and you miss changes that happen between your polling intervals. Webhooks solve both problems: DetectZeStack monitors domains on a schedule and pushes notifications to your server only when something actually changes.

This guide walks through the full webhook lifecycle: creating a subscription, enabling scheduled monitoring, verifying HMAC-signed payloads, and building a working Slack integration that alerts your team when a competitor switches frameworks, adds a CDN, or drops their analytics provider.

Why Monitor Websites for Tech Stack Changes

Technology stack changes are leading indicators. A company adding Stripe is about to launch payments. A competitor switching from Heroku to AWS is preparing to scale. A client removing their Content-Security-Policy header just created a security vulnerability nobody noticed.

Manual checking does not scale. If you are tracking 20 competitor domains, logging in weekly to scan each one is a full hour of repetitive work. And you will miss changes that happen mid-week.

Webhook alerts flip the model: instead of you checking DetectZeStack, DetectZeStack checks the domains and tells you when something changes. Zero wasted effort, zero missed changes.

Use Cases for Webhook Tech Stack Changes Alerts

• Competitive intelligence — get notified when a competitor adds Intercom, switches from React to Next.js, or deploys behind Cloudflare
• Security monitoring — alert when a managed client removes security headers, drops their WAF, or changes SSL configuration
• Sales signals — identify prospects adding payment processors, marketing automation, or analytics tools that indicate buying intent
• Investment due diligence — track portfolio company infrastructure decisions in real time rather than waiting for quarterly updates
• Agency client oversight — catch unauthorized changes to client websites before they become incidents

How DetectZeStack Webhook Alerts Work

The webhook system has three components:

1. Subscription — you register a domain + callback URL pair via POST /webhooks
2. Monitoring — you enable daily or weekly scanning via PATCH /webhooks/{id}
3. Delivery — when changes are detected, DetectZeStack POSTs a signed payload to your URL

The Webhook Lifecycle

Every time a monitored domain is scanned, DetectZeStack diffs the new snapshot against the previous one. If technologies were added, removed, or changed version, a tech_stack.changed event is sent to all active subscribers for that domain. If nothing changed, no notification is sent — your endpoint stays quiet.

Every scan (whether changes were found or not) also fires a tech_stack.analyzed event with the full technology list. This is useful if you want to log every scan result to your own database regardless of whether anything changed.

Step 1 — Create a Webhook Subscription

Register a webhook by POSTing the domain you want to monitor and the URL where you want to receive notifications:

curl -X POST "https://detectzestack.p.rapidapi.com/webhooks" \
-H "x-rapidapi-key: YOUR_API_KEY" \
-H "x-rapidapi-host: detectzestack.p.rapidapi.com" \
-H "Content-Type: application/json" \
-d '{
"domain": "competitor.com",
"webhook_url": "https://your-server.com/hooks/techstack"
}'

Response:

{
"id": 42,
"domain": "competitor.com",
"webhook_url": "https://your-server.com/hooks/techstack",
"hmac_secret": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"
}

The hmac_secret is returned exactly once at creation time. Store it securely — it cannot be retrieved again. You will use it to verify that incoming webhook deliveries actually came from DetectZeStack.

Webhook URLs must use HTTPS. HTTP endpoints are rejected to prevent credentials from being transmitted in plaintext. The URL must also resolve to a public IP address (no localhost or private ranges).

Webhook Limits by Plan

Free tier users can create webhook subscriptions and receive notifications when they manually trigger scans via the API. Scheduled monitoring (automatic daily or weekly scans) requires a paid tier.

Step 2 — Enable Scheduled Monitoring

Creating a webhook subscription does not automatically start monitoring. To have DetectZeStack scan the domain on a schedule, update the subscription with a monitoring interval:

curl -X PATCH "https://detectzestack.p.rapidapi.com/webhooks/42" \
-H "x-rapidapi-key: YOUR_API_KEY" \
-H "x-rapidapi-host: detectzestack.p.rapidapi.com" \
-H "Content-Type: application/json" \
-d '{"monitor_interval": "daily"}'

Response:

{
"status": "updated",
"monitor_interval": "daily"
}

Daily vs Weekly Monitoring Intervals

Choose the interval based on how time-sensitive the information is:

• Daily — best for security monitoring, active competitive tracking, or client oversight where you need to catch changes within 24 hours
• Weekly — sufficient for investment monitoring, long-term trend tracking, or low-priority domains where day-level granularity is unnecessary

To disable monitoring without deleting the webhook, set monitor_interval to an empty string (""). The subscription remains active for manual triggers but no automatic scans occur.

Step 3 — Receive and Verify Webhook Payloads

When changes are detected, DetectZeStack sends an HTTP POST to your registered URL. The request includes:

• Content-Type: application/json
• X-Webhook-Event: tech_stack.analyzed
• X-Webhook-Signature: sha256=<hex-encoded HMAC>

HMAC Signature Verification

Every delivery is signed with your webhook's HMAC secret using SHA-256. To verify:

1. Read the raw request body (do not parse JSON first)
2. Compute HMAC-SHA256 of the raw body using your stored hmac_secret
3. Compare the computed signature against the value in X-Webhook-Signature (after stripping the sha256= prefix)
4. Use constant-time comparison to prevent timing attacks

Python verification example:

import hmac
import hashlib

def verify_signature(payload_body: bytes, secret: str, signature_header: str) -> bool:
"""Verify the HMAC-SHA256 signature from DetectZeStack webhook."""
if not signature_header.startswith("sha256="):
return False

expected_sig = signature_header[7:]  # strip "sha256=" prefix
computed = hmac.new(
secret.encode(),
payload_body,
hashlib.sha256
).hexdigest()

return hmac.compare_digest(computed, expected_sig)

Payload Structure

The webhook payload contains the full scan result along with metadata:

{
"event": "tech_stack.analyzed",
"domain": "competitor.com",
"technologies": [
{
"name": "React",
"categories": ["JavaScript frameworks"],
"version": "18.2.0",
"confidence": 100
},
{
"name": "Cloudflare",
"categories": ["CDN"],
"version": "",
"confidence": 100
},
{
"name": "Next.js",
"categories": ["JavaScript frameworks"],
"version": "14.1.0",
"confidence": 100
},
{
"name": "Google Analytics",
"categories": ["Analytics"],
"version": "",
"confidence": 100
}
],
"meta": {
"scan_time_ms": 1842,
"detection_count": 14
},
"timestamp": "2026-04-20T10:30:00Z"
}

If the scan detected changes compared to the previous snapshot, the payload additionally includes technology change events in the /changes feed that you can query separately for structured diffs (added, removed, version_changed).

Delivery retries: If your endpoint returns a non-2xx status code, DetectZeStack retries up to 3 times with exponential backoff (2 seconds, then 4 seconds). After 3 failures, the delivery is abandoned for that event.

Step 4 — Query the Change Feed for Context

Webhook payloads tell you the current state. To see exactly what changed (what was added or removed), query the /changes endpoint:

curl -s "https://detectzestack.p.rapidapi.com/changes?domain=competitor.com" \
-H "x-rapidapi-key: YOUR_API_KEY" \
-H "x-rapidapi-host: detectzestack.p.rapidapi.com" | python3 -m json.tool

Response:

{
"changes": [
{
"id": 4821,
"domain": "competitor.com",
"technology": "Cloudflare",
"change_type": "added",
"category": "CDN",
"created_at": "2026-04-20T10:30:00Z"
},
{
"id": 4822,
"domain": "competitor.com",
"technology": "Akamai",
"change_type": "removed",
"category": "CDN",
"created_at": "2026-04-20T10:30:00Z"
}
],
"count": 2,
"history_days": 90,
"tier": "pro"
}

Combining webhooks with the change feed gives you the full picture: the webhook tells you something changed, and the change feed tells you exactly what.

Managing Your Webhooks

List Active Webhooks

curl -s "https://detectzestack.p.rapidapi.com/webhooks" \
-H "x-rapidapi-key: YOUR_API_KEY" \
-H "x-rapidapi-host: detectzestack.p.rapidapi.com" | python3 -m json.tool

Response:

{
"webhooks": [
{
"id": 42,
"domain": "competitor.com",
"webhook_url": "https://your-server.com/hooks/techstack",
"monitor_interval": "daily",
"created_at": "2026-04-20T09:00:00Z"
}
],
"count": 1
}

Update or Delete a Webhook

Change the monitoring interval:

curl -X PATCH "https://detectzestack.p.rapidapi.com/webhooks/42" \
-H "x-rapidapi-key: YOUR_API_KEY" \
-H "x-rapidapi-host: detectzestack.p.rapidapi.com" \
-H "Content-Type: application/json" \
-d '{"monitor_interval": "weekly"}'

Delete a subscription entirely:

curl -X DELETE "https://detectzestack.p.rapidapi.com/webhooks/42" \
-H "x-rapidapi-key: YOUR_API_KEY" \
-H "x-rapidapi-host: detectzestack.p.rapidapi.com"

Deleting a webhook stops all monitoring and future deliveries for that subscription immediately.

Full Python Example — Slack Alerts on Tech Stack Changes

Here is a complete Flask application that receives DetectZeStack webhooks, verifies the signature, queries the change feed for context, and posts a formatted message to Slack:

import hmac
import hashlib
import requests
from flask import Flask, request, jsonify

app = Flask(__name__)

WEBHOOK_SECRET = "your_hmac_secret_from_creation"
RAPIDAPI_KEY = "YOUR_API_KEY"
SLACK_WEBHOOK = "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"

@app.route("/hooks/techstack", methods=["POST"])
def handle_webhook():
# Step 1: Verify signature
signature = request.headers.get("X-Webhook-Signature", "")
if not verify_signature(request.data, WEBHOOK_SECRET, signature):
return jsonify({"error": "invalid signature"}), 401

payload = request.json
domain = payload["domain"]

# Step 2: Query the change feed for structured diffs
headers = {
"x-rapidapi-key": RAPIDAPI_KEY,
"x-rapidapi-host": "detectzestack.p.rapidapi.com"
}
resp = requests.get(
f"https://detectzestack.p.rapidapi.com/changes?domain={domain}",
headers=headers
)
changes = resp.json()

if changes["count"] == 0:
return jsonify({"status": "no changes"}), 200

# Step 3: Format and send Slack message
lines = []
for c in changes["changes"]:
prefix = {"added": "+", "removed": "-", "version_changed": "~"}
symbol = prefix.get(c["change_type"], "?")
line = f"[{symbol}] {c['technology']} ({c['category']})"
if c.get("previous_version") and c.get("new_version"):
line += f" {c['previous_version']} -> {c['new_version']}"
lines.append(line)

message = f"*Tech stack change detected on {domain}:*\n```
{% endraw %}
\n"
message += "\n".join(lines[:10])  # limit to 10 changes
message += "\n
{% raw %}
```"

requests.post(SLACK_WEBHOOK, json={"text": message})
return jsonify({"status": "ok"}), 200

def verify_signature(payload_body, secret, signature_header):
if not signature_header.startswith("sha256="):
return False
expected = signature_header[7:]
computed = hmac.new(
secret.encode(), payload_body, hashlib.sha256
).hexdigest()
return hmac.compare_digest(computed, expected)

if __name__ == "__main__":
app.run(port=5000)

Deploy this behind HTTPS (using nginx, Caddy, or a platform like Railway) and register the public URL as your webhook endpoint. The entire pipeline — detection, notification, and alerting — runs automatically without any polling or cron jobs on your side.

Try It: Scan a Domain with the Demo Endpoint

Before setting up webhooks, verify what DetectZeStack detects for a given domain using the free demo endpoint (no API key required):

curl -s "https://detectzestack.com/demo?url=https://stripe.com" | python3 -m json.tool

This returns the full technology list for stripe.com — the same data structure that webhook payloads use. Use this to validate that the domains you plan to monitor produce useful detection results before investing in webhook setup.

Webhook Limits and Tier Comparison

All plans include HMAC signature verification and automatic retry with exponential backoff. The difference between tiers is how many domains you can monitor simultaneously and whether scheduled (automatic) monitoring is available.

Get Started with Webhook Tech Stack Changes Alerts

Setting up webhook-based tech stack monitoring takes about five minutes:

1. Get your API key from RapidAPI (free tier includes 5 webhook subscriptions)
2. Create a subscription with POST /webhooks for each domain you want to monitor
3. Enable scheduled monitoring with PATCH /webhooks/{id} (paid tiers)
4. Implement signature verification in your webhook handler
5. Route notifications to Slack, PagerDuty, email, or your own dashboard

No polling. No cron jobs. No wasted API requests checking domains that have not changed. DetectZeStack handles the scanning, diffing, and notification delivery — you just receive the alerts.

Related Reading

• Track Website Tech Changes Over Time via API — Full guide to /changes, /history, and /webhooks endpoints
• Automate Security Audits with the DetectZeStack API — Combine webhooks with security header monitoring
• How to Batch Scan 1,000 Websites for Tech Stack Data — Bulk scanning for initial baseline before enabling webhook monitoring
• Competitor Website Technology Analysis — Use tech stack data for competitive intelligence
• Technology Change Monitor — Interactive dashboard for tracking tech stack changes