HPE Aruba Networking Central has the ability to report on all types of events enabling users to have a strong pulse on the health and status of their network. Users with the Administrator role can enable and configure these alerts within the Alert Management card. For a full list of supported alert types, refer to the Central documentation .

Webhook Alert Structure

When an alert is configured to notify the user via Webhook, the alert is sent out as a JSON formatted string within an HTTP POST. The data in this JSON string contains information regarding the type of alert, the alerts priority, as well as other details and identifiers.

Each alert will follow the same structure as defined below with event specific details being nested with the impactedEntities and additionalDetails keys:

Field	Description
id	Unique identifier for this Webhook event
alertId	Unique identifier for the alert, this will match additional messages relating to this particular alert event e.g. resolved or cleared.
tenantId	Customer or tenant ID where the alert occurred
tenantName	Name of the tenant account, applicable for MSP only.
mspId	Managed Service Provider identifier, applicable for MSP only.
mspName	MSP organization name, applicable for MSP only.
name	Alert type (e.g., "AP Rebooted")
category	Alert category (e.g., "System", "Client")
deviceType	Type of device (e.g., "Access Point", "Gateway")
severity	Alert severity level (Critical, Major, Minor, Info)
time	Timestamp when alert occurred (ISO 8601 format)
operation	Used in conjunction with state to describe whether the alert is new (Add) or is being updated (Update)
state	Alert state describes the status of the alert, see below for detailed description (Active, Cleared)
siteId	Site scope-id
configScope	Configuration scope of the alert (Global, Site, Device)
summary	Alert description
notes	Additional notes
impactedEntities	Dictionary containing the keys deviceSerial and clientMac which correlate to lists of either Clients or Devices that are affected by the alert.
additionalDetails	A list of dictionaries correlating to the # of devices/clients affected by the alert. Dictionaries will contain device/client specific data pertaining to the type of alert.

Below are example Webhook notifications sent by HPE Aruba Networking Central:

{
  "id": "fb2bfbb4-5b28-427c-812f-f559e72bb8b8",
  "alertId": "ea017ba0-e893-3191-b1c7-32d3e2a36456",
  "tenantId": "67757962001e11f0a9871686f991bdfb",
  "tenantName": null,
  "mspId": null,
  "mspName": null,
  "name": "5 GHz Channel Quality",
  "category": "WLAN",
  "deviceType": "Access Point",
  "severity": "Critical",
  "time": "2026-01-20T19:59:00.860Z",
  "operation": "Add",
  "state": "Active",
  "siteId": "47020865885560832",
  "configScope": "Global",
  "summary": "AP test-ap channel quality was 68% for 30 minutes on the 5 GHz channel 48E which is lower than the threshold of 70%.",
  "notes": null,
  "impactedEntities": {
    "deviceSerial": [
      "VNQ7KZD4JB"
    ],
    "clientMac": []
  },
  "additionalDetails": [
    {
      "deviceSerial": "VNQ7KZD4JB",
      "firmwareVersion": "10.5.1.1-10.5.1.1_89665",
      "hostname": "test-ap",
      "radioMac": "dc:b7:ac:4d:ea:30",
      "channel": "48E",
      "band": "5 GHz",
      "bandRange": ""
    }
  ]
}

{
  "id": "4147f4f7-cbc8-4575-80fa-5f556cead817",
  "alertId": "c8efde3d-3c90-3484-bc92-4661f0a74ce7",
  "tenantId": "67757962001e11f0a9871686f991bdfb",
  "tenantName": null,
  "mspId": null,
  "mspName": null,
  "name": "All Radios Disabled",
  "category": "WLAN",
  "deviceType": "Access Point",
  "severity": "Critical",
  "time": "2026-01-21T04:32:47.153Z",
  "operation": "Update",
  "state": "Cleared",
  "siteId": "45078554510",
  "configScope": "Global",
  "summary": "All radios are disabled on AP dc:b7:ac:cc:e5:98 with MAC address dc:b7:ac:cc:e5:98.",
  "notes": null,
  "impactedEntities": {
    "deviceSerial": [
      "VNQ7KZD4P5"
    ],
    "clientMac": []
  },
  "additionalDetails": [
    {
      "deviceSerial": "VNQ7KZD4P5",
      "firmwareVersion": "10.5.1.1-10.5.1.1_89665",
      "hostname": "dc:b7:ac:cc:e5:98"
    }
  ]
}

{
  "id": "5ef55a62-cc3f-479c-843d-112fa9c1e777",
  "alertId": "58899ebe-d0a8-38d0-af14-23fee02e1299",
  "tenantId": "67757962001e11f0a9871686f991bdfb",
  "tenantName": null,
  "mspId": null,
  "mspName": null,
  "name": "AP Rebooted",
  "category": "System",
  "deviceType": "Access Point",
  "severity": "Critical",
  "time": "2026-01-21T04:39:45.418Z",
  "operation": "Add",
  "state": "Active",
  "siteId": "47020865885560832",
  "configScope": "Global",
  "summary": "Access Point test-ap rebooted due to: AP Reboot issued via CLI",
  "notes": null,
  "impactedEntities": {
    "deviceSerial": [
      "VNQ7KZD4JB"
    ],
    "clientMac": []
  },
  "additionalDetails": [
    {
      "deviceSerial": "VNQ7KZD4JB",
      "hostname": "test-ap",
      "rebootReason": "AP Reboot issued via CLI"
    }
  ]
}

Alert State

When users receive a new alert that is forwarded to the configured Webhook, there exists a field titled state in the JSON string which denotes the state of the alert received. When an alert is first triggered, the Webhook notification will be sent with the state set to Active and the operation field set to Add .

When that same alert is resolved, either by being fixed by the network or cleared by a user through the UI, another Webhook notification will be sent with the operation field set to Update and the state field set to Cleared. Additionally, the alertId field will be unique to an alert event, when updates occur to the same alert, incoming messages pertaining to that event will share the same value for alertId.

For example, if an AP is rebooted and then returns online (resolving the event), a user will receive two Webhook messages with matching alertId values. See below:

{
  "id": "4e14738d-7b85-491f-8f80-c10e8c0bb9ea",
  "alertId": "58899ebe-d0a8-38d0-af14-23fee02e1299",
  "tenantId": "67757962001e11f0a9871686f991bdfb",
  "tenantName": null,
  "mspId": null,
  "mspName": null,
  "name": "AP Rebooted",
  "category": "System",
  "deviceType": "Access Point",
  "severity": "Critical",
  "time": "2026-01-16T20:14:24.074Z",
  "operation": "Add",
  "state": "Active",
  "siteId": "47020865885560832",
  "configScope": "Global",
  "summary": "Access Point test-ap rebooted due to: AP Reboot issued via CLI",
  "notes": null,
  "impactedEntities": {
    "deviceSerial": [
      "VNQ7KZD4JB"
    ],
    "clientMac": []
  },
  "additionalDetails": [
    {
      "deviceSerial": "VNQ7KZD4JB",
      "hostname": "test-ap",
      "rebootReason": "AP Reboot issued via CLI"
    }
  ]
}

{
  "id": "7da40627-0d0d-4b0e-bdcb-c7424f30c48f",
  "alertId": "58899ebe-d0a8-38d0-af14-23fee02e1299",
  "tenantId": "67757962001e11f0a9871686f991bdfb",
  "tenantName": null,
  "mspId": null,
  "mspName": null,
  "name": "AP Rebooted",
  "category": "System",
  "deviceType": "Access Point",
  "severity": "Critical",
  "time": "2026-01-16T21:12:26.650Z",
  "operation": "Update",
  "state": "Cleared",
  "siteId": "47020865885560832",
  "configScope": "Global",
  "summary": "Access Point test-ap rebooted due to: AP Reboot issued via CLI",
  "notes": null,
  "impactedEntities": {
    "deviceSerial": [
      "VNQ7KZD4JB"
    ],
    "clientMac": []
  },
  "additionalDetails": [
    {
      "deviceSerial": "VNQ7KZD4JB",
      "hostname": "test-ap",
      "rebootReason": "AP Reboot issued via CLI"
    }
  ]
}

Additionally, if an alert is "deferred" from the Central UI, another Webhook notification will be sent with the operation field set to Update and the state field set to Deferred. Similar to when an alert is resolved, when an alert is deferred, the alertId field will be unique to that alert event, and the incoming message will share the same value for alertId as the original.