# Webhook Alert Event IDs

The following table lists the supported webhook alert subscriptions and their corresponding Event IDs used in webhook payloads.

| Subscribed Alert                           | Event ID                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Online                                     | • device\_online                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Offline                                    | • device\_offline                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Rogue SSID is detected                     | • rogue\_ssid\_detected                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Evil Twins Attack is detected              | <p>• ap\_wids\_eviltwin\_ap\_impersonation\_start</p><p>• ap\_wids\_eviltwin\_ap\_impersonation\_update</p><p>• ap\_wids\_eviltwin\_ap\_impersonation\_end</p><p>• ap\_wids\_eviltwin\_ap\_spoofing\_start</p><p>• ap\_wids\_eviltwin\_ap\_spoofing\_update</p><p>• ap\_wids\_eviltwin\_ap\_spoofing\_end</p>                                                                                                                                                                                                                                                                                                                                                                                                      |
| Malicious Attack is detected               | <p>• ap\_wids\_deauth\_ap\_start</p><p>• ap\_wids\_deauth\_ap\_update</p><p>• ap\_wids\_deauth\_ap\_end</p><p>• ap\_wids\_deauth\_sta\_start</p><p>• ap\_wids\_deauth\_sta\_update</p><p>• ap\_wids\_deauth\_sta\_end</p><p>• ap\_wids\_deauth\_others\_start</p><p>• ap\_wids\_deauth\_others\_update</p><p>• ap\_wids\_deauth\_others\_end</p><p>• ap\_wids\_disassoc\_ap\_start</p><p>• ap\_wids\_disassoc\_ap\_update</p><p>• ap\_wids\_disassoc\_ap\_end</p><p>• ap\_wids\_disassoc\_sta\_start</p><p>• ap\_wids\_disassoc\_sta\_update</p><p>• ap\_wids\_disassoc\_sta\_end</p><p>• ap\_wids\_disassoc\_others\_start</p><p>• ap\_wids\_disassoc\_others\_update</p><p>• ap\_wids\_disassoc\_others\_end</p> |
| RF Jamming is detected                     | <p>• ap\_wids\_jamming\_start</p><p>• ap\_wids\_jamming\_update</p><p>• ap\_wids\_jamming\_end</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| DFS Radar Detected                         | • ap\_dfs\_radar\_detected                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Client went down                           | <p>• ap\_client\_wpa\_deauth</p><p>• ap\_client\_eap\_deauth</p><p>• ap\_client\_disassoc</p><p>• ap\_steer\_kick\_sta</p><p>• ap\_kick\_station</p><p>• ap\_clear\_station</p><p>• ap\_cloud\_kick\_station</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Client WPA or 802.1X authentication failed | <p>• ap\_client\_wpa\_auth\_fail</p><p>• ap\_client\_eap\_auth\_fail</p><p>• ap\_client\_deny\_auth</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| AP reboot                                  | <p>• ap\_sys\_info\_bootup</p><p>• ap\_sys\_info\_shutdown</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Configuration changed within network       | <p>• ssid\_creation</p><p>• ssid\_update</p><p>• ssid\_removal</p><p>• radio\_update</p><p>• general\_ap\_remote\_syslog\_change</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://doc.engenius.ai/webhook/webhook-sample-alerts/ap/webhook-alert-event-ids.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.