Skip to main content
Question

Nexthink Webhook Payloads

  • June 8, 2026
  • 1 reply
  • 27 views
R
Forum|alt.badge.img+5

Anyone know anything about the Nexthink webhook payloads. 

I currently have it set up and working with the Moveworks API and it passes all the parameters correctly except for user email.

 

alert.alerts
| where monitor.name == "test_alert_gb"
| list device.name,
       device.login.last_login_user_name,
       device.collector.uid,
       alert.context,
       trigger_time,
       recovery_time,
       device_view_link,
       issue_view_link

^ NQL QUERY

{
  "recipients": [
    "{{alert.alert.context.user.ad.email_address}}"
  ],
  "event_data": {
    "username": "{{device.device.login.last_login_user_name}}",
    "user_email": "{{alert.alert.context.user.ad.email_address}}",
    "device_uid": "{{device.device.collector.uid}}",
    "device_name": "{{device.device.name}}",
    "trigger_time": "{{alert.alert.trigger_time}}",
    "recovery_time": "{{alert.alert.recovery_time}}",
    "device_view_link": "{{alert.alert.device_view_link}}",
    "issue_view_link": "{{alert.alert.issue_view_link}}"
  }
}

^ Example Payload

"root":{
"accessed_variables":{
"event_data":{
"user_email":"{{alert.alert.context.user.ad.email_address}}" <---  THE ISSUE
"issue_view_link":""
"device_uid":"***********"
"device_name":"*********"
"trigger_time":"2026-06-08 16:30:00"
"device_view_link":"************"
"recovery_time":""
"username":"*******"
}

*** = censored
^ Received payload

 

    1 reply

    rgeroulo
    Forum|alt.badge.img+2
    • rgeroulo
    • Community Manager
    • June 9, 2026

    Hey ​@reid.mozley!

    I believe the user email typically needs to be sourced from the user table in Nexthink. Something like the following is typically used in the NQL query:

    • compute user_email = user.ad.email_address

    In this example, the user table is sourced from Active Directory. The first step would to confirm that your identity system syncs to Nexthink. If so, then you should be able to dot-walk to it.

    Best,

    Ryan

    Terms & ConditionsAccessibility statement