Skip to content

What TradingView sends#

TradingView fires alerts as HTTP POST requests with a JSON body. HookTrader exposes one URL per webhook:

POST https://hooktrader.app/webhook/{token}

The {token} is a UUID generated when you create the strategy. Treat it like a password — anyone who has the URL can fire your strategy (subject to per-token rate-limits and the stale-alert guard).

The request#

  • Method: POST
  • Content-Type: TradingView sends text/plain; charset=utf-8 by default. HookTrader parses the body as JSON regardless of the header.
  • Body: the contents of the alert's Message box (or, for Pine alert(), the string passed to alert()).
  • No auth headers. TradingView doesn't support them; the URL token is the only credential.

What HookTrader does on receipt#

HookTrader answers 202 Accepted almost immediately and continues processing in the background:

  1. Stale-alert guard — drop the alert if it's older than STALE_ALERT_SECONDS (default 30s). See Stale-alert guard.
  2. Rate-limit check — per-token bucket; protects against runaway alert loops.
  3. Optional payload translation — your saved mapping rules turn the raw payload into a canonical v2 envelope.
  4. Credential decrypt — decrypt the bound API key securely.
  5. Endpoint selection — pick testnet or mainnet based on the key's mode.
  6. Dispatch — HookTrader processes the event type (entry, tp_hit, trail, move_sl, exit, custom) and executes the corresponding exchange operations.
  7. Persist — the trade, its legs, and event history are saved.

If anything in steps 1–5 rejects the alert, the receiver logs it to the webhook log on the strategy detail page. Ignored alerts (duplicates, signals while no trade is open, etc.) are silent; rejected alerts that look like real problems (mapping failures, validation errors) raise a notification.

Status codes#

Code Meaning
202 Accepted Enqueued. The actual outcome is in the webhook log + notifications.
400 Bad Request Body wasn't parseable JSON.
401 Unauthorized Token doesn't match any webhook.
403 Forbidden Webhook is paused or draft.
429 Too Many Requests Per-token rate limit.
503 Service Unavailable Exchange in IP-ban cooldown — comes with a Retry-After header.

TradingView retries on 5xx by default. We deliberately answer 2xx immediately so a successfully-received alert doesn't get duplicated by a retry — see Stale-alert guard for the second layer of duplicate protection.