Alert Sources

Configure your alert sources in incident.io. Alert sources are the systems that send alerts to incident.io, which can then be routed to the right people and teams.

The alert source object

string

required

The ID of this alert source

Example:

"01GW2G3V0S59R238FAHPDS1R66"

name

string

required

Unique name of the alert source

Example:

"Production Web Dashboard Alerts"

source_type

enum<string>

required

Type of alert source

Available options:

alertmanager,

app_optics,

azure_monitor,

azure_devops,

big_panda,

bugsnag,

checkly,

chronosphere,

cloudwatch,

cloudflare,

coralogix,

cronitor,

crowdstrike_falcon,

dash0,

datadog,

dynatrace,

elasticsearch,

email,

expel,

github_issue,

google_cloud,

grafana,

heartbeat,

http,

http_custom,

honeycomb,

icinga2,

incoming_calls,

jira,

jsm,

monte_carlo,

nagios,

new_relic,

opsgenie,

prtg,

pager_duty,

panther,

pingdom,

runscope,

sns,

sentry,

sentry_metric,

service_now,

splunk,

status_cake,

status_page_views,

sumo_logic,

uptime,

vercel,

wiz,

zendesk

Example:

"alertmanager"

template

object

required

Show child attributes

Example:

{
  "attributes": [
    {
      "alert_attribute_id": "abc123",
      "binding": {
        "array_value": [
          {
            "label": "Lawrence Jones",
            "literal": "SEV123",
            "reference": "incident.severity"
          }
        ],
        "merge_strategy": "first_wins",
        "value": {
          "label": "Lawrence Jones",
          "literal": "SEV123",
          "reference": "incident.severity"
        }
      }
    }
  ],
  "description": {
    "label": "Lawrence Jones",
    "literal": "SEV123",
    "reference": "incident.severity"
  },
  "expressions": [
    {
      "else_branch": {
        "result": {
          "array_value": [
            {
              "label": "Lawrence Jones",
              "literal": "SEV123",
              "reference": "incident.severity"
            }
          ],
          "value": {
            "label": "Lawrence Jones",
            "literal": "SEV123",
            "reference": "incident.severity"
          }
        }
      },
      "label": "Team Slack channel",
      "operations": [
        {
          "branches": {
            "branches": [
              {
                "condition_groups": [
                  {
                    "conditions": [
                      {
                        "operation": {
                          "label": "Lawrence Jones",
                          "value": "01FCQSP07Z74QMMYPDDGQB9FTG"
                        },
                        "param_bindings": [
                          {
                            "array_value": [
                              {
                                "label": "Lawrence Jones",
                                "literal": "SEV123",
                                "reference": "incident.severity"
                              }
                            ],
                            "value": {
                              "label": "Lawrence Jones",
                              "literal": "SEV123",
                              "reference": "incident.severity"
                            }
                          }
                        ],
                        "subject": {
                          "label": "Incident Severity",
                          "reference": "incident.severity"
                        }
                      }
                    ]
                  }
                ],
                "result": {
                  "array_value": [
                    {
                      "label": "Lawrence Jones",
                      "literal": "SEV123",
                      "reference": "incident.severity"
                    }
                  ],
                  "value": {
                    "label": "Lawrence Jones",
                    "literal": "SEV123",
                    "reference": "incident.severity"
                  }
                }
              }
            ],
            "returns": { "array": true, "type": "IncidentStatus" }
          },
          "cast": {
            "returns": { "array": true, "type": "IncidentStatus" }
          },
          "concatenate": {
            "reference": "1235",
            "reference_label": "Teams"
          },
          "filter": {
            "condition_groups": [
              {
                "conditions": [
                  {
                    "operation": {
                      "label": "Lawrence Jones",
                      "value": "01FCQSP07Z74QMMYPDDGQB9FTG"
                    },
                    "param_bindings": [
                      {
                        "array_value": [
                          {
                            "label": "Lawrence Jones",
                            "literal": "SEV123",
                            "reference": "incident.severity"
                          }
                        ],
                        "value": {
                          "label": "Lawrence Jones",
                          "literal": "SEV123",
                          "reference": "incident.severity"
                        }
                      }
                    ],
                    "subject": {
                      "label": "Incident Severity",
                      "reference": "incident.severity"
                    }
                  }
                ]
              }
            ]
          },
          "navigate": {
            "reference": "1235",
            "reference_label": "Teams"
          },
          "operation_type": "navigate",
          "parse": {
            "returns": { "array": true, "type": "IncidentStatus" },
            "source": "metadata.annotations[\"github.com/repo\"]"
          },
          "returns": { "array": true, "type": "IncidentStatus" }
        }
      ],
      "reference": "abc123",
      "returns": { "array": true, "type": "IncidentStatus" },
      "root_reference": "incident.status"
    }
  ],
  "is_private": false,
  "title": {
    "label": "Lawrence Jones",
    "literal": "SEV123",
    "reference": "incident.severity"
  },
  "visible_to_teams": {
    "array_value": [
      {
        "label": "Lawrence Jones",
        "literal": "SEV123",
        "reference": "incident.severity"
      }
    ],
    "value": {
      "label": "Lawrence Jones",
      "literal": "SEV123",
      "reference": "incident.severity"
    }
  }
}

alert_events_url

string

URL that can be used to send alert events to this source. This is only set for sources that accept webhook/HTTP events; email sources use the email_address field, and integration-based sources (like Jira) receive events through their native integrations.

Example:

"https://api.incident.io/v2/alert_events/http/01GW2G3V0S59R238FAHPDS1R66"

auto_resolve_incident_alerts

boolean

Whether alerts from this source keep counting down to auto-resolve while attached to an incident. Defaults to true. Has no effect without auto_resolve_timeout_minutes.

Example:

false

auto_resolve_timeout_minutes

integer<int64>

When set, alerts from this source will automatically resolve after this many minutes.

Example:

1

azure_devops_options

object

Show child attributes

Example:

{
  "project_ids": [
    "01GBSQF3FHF7FWZQNWGHAVQ804",
    "ba038695-f5f7-4490-a9ea-bf4ab3cbf483"
  ]
}

email_options

object

Show child attributes

Example:

{
  "email_address": "lawrence@example.com",
  "redactions": ["credit_card_numbers"],
  "transform_expression": "return {\n  title: $.subject,\n  description: $.text,\n  status: $.subject.startsWith('[RESOLVED]') ? 'resolved' : 'firing',\n  deduplication_key: $.header_message_id,\n}"
}

fixed_team_id

string

When set, the team every alert from this source is attributed to. The team attribute is managed from this field: its binding is not returned in the template and cannot be edited directly.

Example:

"01G0J1EXE7AXZ2C93K61WBPYEH"

heartbeat_options

object

Show child attributes

Example:

{
  "failure_threshold": 1,
  "grace_period_seconds": 0,
  "interval_seconds": 60,
  "ping_url": "https://api.incident.io/v2/heartbeat/01GW2G3V0S59R238FAHPDS1R66/ping"
}

http_custom_options

object

Show child attributes

Example:

{
  "deduplication_key_path": "$.alert_id",
  "transform_expression": "return {\n  title: $.title || $.name || 'Unknown Alert',\n  status: $.status === 'resolved' ? 'resolved' : 'firing',\n  description: $.description || $.message || '',\n  sourceURL: $.url || $.link || '',\n  metadata: { team: $.team, severity: $.severity }\n}"
}

jira_options

object

Show child attributes

Example:

{
  "project_ids": ["01GBSQF3FHF7FWZQNWGHAVQ804", "10043"]
}

owning_team_ids

string[]

IDs of teams that own this alert source

Example:

["01G0J1EXE7AXZ2C93K61WBPYEH"]

rate_limit_sharding

object

Controls how this source's ingest rate limit is split into buckets.

Show child attributes

Example:

{ "rate_limit_shard_key_path": "$.priority" }

secret_token

string

Secret token used to authenticate this source, if applicable. If applicable, this is the token that must be included in either the query string or the 'Authorization' header when sending events to this alert source.

Example:

"some-secret-token"

{
  "id": "01GW2G3V0S59R238FAHPDS1R66",
  "name": "Production Web Dashboard Alerts",
  "source_type": "alertmanager",
  "template": {
    "attributes": [
      {
        "alert_attribute_id": "abc123",
        "binding": {
          "array_value": [
            {
              "label": "Lawrence Jones",
              "literal": "SEV123",
              "reference": "incident.severity"
            }
          ],
          "merge_strategy": "first_wins",
          "value": {
            "label": "Lawrence Jones",
            "literal": "SEV123",
            "reference": "incident.severity"
          }
        }
      }
    ],
    "description": {
      "label": "Lawrence Jones",
      "literal": "SEV123",
      "reference": "incident.severity"
    },
    "expressions": [
      {
        "else_branch": {
          "result": {
            "array_value": [
              {
                "label": "Lawrence Jones",
                "literal": "SEV123",
                "reference": "incident.severity"
              }
            ],
            "value": {
              "label": "Lawrence Jones",
              "literal": "SEV123",
              "reference": "incident.severity"
            }
          }
        },
        "label": "Team Slack channel",
        "operations": [
          {
            "branches": {
              "branches": [
                {
                  "condition_groups": [
                    {
                      "conditions": [
                        {
                          "operation": {
                            "label": "Lawrence Jones",
                            "value": "01FCQSP07Z74QMMYPDDGQB9FTG"
                          },
                          "param_bindings": [
                            {
                              "array_value": [
                                {
                                  "label": "Lawrence Jones",
                                  "literal": "SEV123",
                                  "reference": "incident.severity"
                                }
                              ],
                              "value": {
                                "label": "Lawrence Jones",
                                "literal": "SEV123",
                                "reference": "incident.severity"
                              }
                            }
                          ],
                          "subject": {
                            "label": "Incident Severity",
                            "reference": "incident.severity"
                          }
                        }
                      ]
                    }
                  ],
                  "result": {
                    "array_value": [
                      {
                        "label": "Lawrence Jones",
                        "literal": "SEV123",
                        "reference": "incident.severity"
                      }
                    ],
                    "value": {
                      "label": "Lawrence Jones",
                      "literal": "SEV123",
                      "reference": "incident.severity"
                    }
                  }
                }
              ],
              "returns": {
                "array": true,
                "type": "IncidentStatus"
              }
            },
            "cast": {
              "returns": {
                "array": true,
                "type": "IncidentStatus"
              }
            },
            "concatenate": {
              "reference": "1235",
              "reference_label": "Teams"
            },
            "filter": {
              "condition_groups": [
                {
                  "conditions": [
                    {
                      "operation": {
                        "label": "Lawrence Jones",
                        "value": "01FCQSP07Z74QMMYPDDGQB9FTG"
                      },
                      "param_bindings": [
                        {
                          "array_value": [
                            {
                              "label": "Lawrence Jones",
                              "literal": "SEV123",
                              "reference": "incident.severity"
                            }
                          ],
                          "value": {
                            "label": "Lawrence Jones",
                            "literal": "SEV123",
                            "reference": "incident.severity"
                          }
                        }
                      ],
                      "subject": {
                        "label": "Incident Severity",
                        "reference": "incident.severity"
                      }
                    }
                  ]
                }
              ]
            },
            "navigate": {
              "reference": "1235",
              "reference_label": "Teams"
            },
            "operation_type": "navigate",
            "parse": {
              "returns": {
                "array": true,
                "type": "IncidentStatus"
              },
              "source": "metadata.annotations[\"github.com/repo\"]"
            },
            "returns": {
              "array": true,
              "type": "IncidentStatus"
            }
          }
        ],
        "reference": "abc123",
        "returns": {
          "array": true,
          "type": "IncidentStatus"
        },
        "root_reference": "incident.status"
      }
    ],
    "is_private": false,
    "title": {
      "label": "Lawrence Jones",
      "literal": "SEV123",
      "reference": "incident.severity"
    },
    "visible_to_teams": {
      "array_value": [
        {
          "label": "Lawrence Jones",
          "literal": "SEV123",
          "reference": "incident.severity"
        }
      ],
      "value": {
        "label": "Lawrence Jones",
        "literal": "SEV123",
        "reference": "incident.severity"
      }
    }
  },
  "alert_events_url": "https://api.incident.io/v2/alert_events/http/01GW2G3V0S59R238FAHPDS1R66",
  "auto_resolve_incident_alerts": false,
  "auto_resolve_timeout_minutes": 1,
  "azure_devops_options": {
    "project_ids": [
      "01GBSQF3FHF7FWZQNWGHAVQ804",
      "ba038695-f5f7-4490-a9ea-bf4ab3cbf483"
    ]
  },
  "email_options": {
    "email_address": "lawrence@example.com",
    "redactions": [
      "credit_card_numbers"
    ],
    "transform_expression": "return {\n  title: $.subject,\n  description: $.text,\n  status: $.subject.startsWith('[RESOLVED]') ? 'resolved' : 'firing',\n  deduplication_key: $.header_message_id,\n}"
  },
  "fixed_team_id": "01G0J1EXE7AXZ2C93K61WBPYEH",
  "heartbeat_options": {
    "failure_threshold": 1,
    "grace_period_seconds": 0,
    "interval_seconds": 60,
    "ping_url": "https://api.incident.io/v2/heartbeat/01GW2G3V0S59R238FAHPDS1R66/ping"
  },
  "http_custom_options": {
    "deduplication_key_path": "$.alert_id",
    "transform_expression": "return {\n  title: $.title || $.name || 'Unknown Alert',\n  status: $.status === 'resolved' ? 'resolved' : 'firing',\n  description: $.description || $.message || '',\n  sourceURL: $.url || $.link || '',\n  metadata: { team: $.team, severity: $.severity }\n}"
  },
  "jira_options": {
    "project_ids": [
      "01GBSQF3FHF7FWZQNWGHAVQ804",
      "10043"
    ]
  },
  "owning_team_ids": [
    "01G0J1EXE7AXZ2C93K61WBPYEH"
  ],
  "rate_limit_sharding": {
    "rate_limit_shard_key_path": "$.priority"
  },
  "secret_token": "some-secret-token"
}

Getting started

Webhooks

Audit logs

Deprecated endpoints

The alert source object

​The alert source object

The alert source object