Skip to main content
Configure incident Webhook. When specific operations occur on incidents (such as trigger or close), the system makes an HTTP callback to your configured address. The callback content includes the incident’s latest key information, allowing integration with your custom tools.

​
1. Event Types

The following event types are currently supported; more may be added in the future.
Event TypeDescription
i_newCreate incident (auto or manual)
i_assignAssign incident (auto or manual)
i_snoozeManually snooze incident
i_wakeCancel snooze
i_ackManually acknowledge incident
i_unackCancel acknowledgment
i_stormTrigger storm warning
i_customTrigger custom action
i_rslvClose incident (auto or manual)
i_reopenReopen incident
i_mergeManually merge incident
i_commAdd comment
i_r_titleUpdate incident title
i_r_descUpdate incident description
i_r_impactUpdate incident impact
i_r_rcUpdate incident root cause
i_r_rsltnUpdate incident resolution
i_r_severityUpdate incident severity
i_r_fieldUpdate incident custom field

​
2. Push Description

​
Request Method

POST, Content-Type:“application/json”

​
Request Payload:

FieldTypeRequiredDescription
event_timeint64YesEvent timestamp in milliseconds
event_typestringYesEvent type, enum values see Event Types
event_idstringYesEvent ID, the same event may retry multiple times due to timeout, receiver needs to deduplicate
personPersonNoOperator, only exists for human actions
incidentIncidentYesIncident details
Person:
FieldTypeRequiredDescription
person_idint64YesPerson ID
person_namestringYesPerson name
emailstringYesEmail address
Responder:
FieldTypeRequiredDescription
person_idint64YesPerson ID
person_namestringYesPerson name
emailstringYesEmail address
assigned_atint64NoAssignment time
acknowledged_atint64NoAcknowledgment time
Incident:
FieldTypeRequiredDescription
incident_idstringYesIncident ID
titlestringYesIncident title
descriptionstringNoIncident description
impactstringNoIncident impact
root_causestringNoIncident root cause
resolutionstringNoIncident resolution
incident_severitystringYesSeverity, enum: Critical, Warning, Info
incident_statusstringYesIncident status, enum: Critical, Warning, Info, Ok
progressstringYesProgress, enum: Triggered, Processing, Closed
created_atint64YesCreated time
updated_atint64YesUpdated time
start_timeint64YesTrigger time, Unix seconds timestamp
last_timeint64NoLatest event time, latest event push time in associated alerts, Unix seconds timestamp, default 0
end_timeint64NoRecovery time, incident auto-recovers when all associated alerts recover, Unix seconds timestamp, default 0
ack_timeint64NoFirst acknowledgment time, incident can be acknowledged by multiple people, this is the earliest acknowledgment time. Unix seconds timestamp, default 0
close_timeint64NoClose time, end_time represents incident recovery time, close_time represents progress close time, incident closes when recovered, closing doesn’t affect recovery. Unix seconds timestamp, default 0
snoozed_beforeint64NoSnooze deadline
labelsmap[string]stringNoLabel KV, both Key and Value are strings. Not present for manual creation, for auto creation it’s the labels of the first grouped alert
fieldsmap[string]interfaceNoCustom field KV, Key is string, Value can be any type depending on field type
creatorPersonNoCreator info, only exists for manually created incidents
closerPersonNoCloser info, only exists for manually closed incidents
responders[]ResponderNoResponders list, only exists after incident is assigned. May be empty for i_new event
alert_cntint64NoAssociated alert count
channel_idint64NoChannel ID, 0 means not belonging to any channel
channel_namestringNoChannel name
detail_urlstringYesDetail URL
group_methodstringNoGrouping method, enum: n: no grouping, p: rule-based grouping, i: intelligent grouping

​
Request Response

HTTP status code 200 indicates successful push.

​
Request Example

curl -X POST 'https://example.com/incident/webhook?a=a' \
-H 'Content-Type: application/json' \
-H 'X-Customize-Header-A: a' \
-d '{
    "event_id":"fac0599a2a25529ba2362c0c184b6cfb",
    "event_time":1689335086948,
    "event_type":"i_new",
    "incident":{
        "account_id":74058170041504,
        "account_name":"TouTie Tech",
        "ack_time":0,
        "alert_cnt":0,
        "assigned_to":{
            "assigned_at":1689335086,
            "escalate_rule_id":"64abb8a687e7984845822139",
            "escalate_rule_name":"Default Escalation",
            "id":"NBRbNwDSTSMijKXdLtBU3T",
            "layer_idx":0,
            "type":"assign"
        },
        "channel_id":1840312623504,
        "channel_name":"Reduce Noise",
        "close_time":0,
        "created_at":1689335086,
        "creator":{
            "email":"toutie@flashcat.cloud",
            "person_id":1552048792504,
            "person_name":"TouTie"
        },
        "creator_id":1552048792504,
        "data_source_id":0,
        "dedup_key":"",
        "description":"",
        "detail_url":"http://10.206.0.17:8567/incident/detail/64b1352e376e32c85c56e25b",
        "end_time":0,
        "equals_md5":"",
        "group_method":"n",
        "impact":"",
        "incident_id":"64b1352e376e32c85c56e25b",
        "incident_severity":"Critical",
        "incident_status":"Critical",
        "labels":{
            "check": "cpu idle low"
        },
        "last_time":1689335086,
        "num":"56E25B",
        "progress":"Triggered",
        "resolution":"",
        "responder_ids":[
            1552048792504
        ],
        "responders":[
            {
                "acknowledged_at":0,
                "assigned_at":1689335086,
                "email":"toutie@flashcat.cloud",
                "person_id":1552048792504,
                "person_name":"TouTie"
            }
        ],
        "root_cause":"",
        "snoozed_before":0,
        "start_time":1689335086,
        "title":"ysy028",
        "updated_at":1689335086
    },
    "person":{
        "email":"toutie@flashcat.cloud",
        "person_id":1552048792504,
        "person_name":"TouTie"
    }
}' -v

​
3. FAQ

  1. Is there a response timeout?
    • Service needs to return response within 2 seconds; exceeding 2 seconds is considered a failure
  2. Will pushes continue after failure?
Retries for specific network errors, max 1 retries:
  • context deadline exceeded (excluding awaiting headers)
  • i/o timeout
  • eof
  1. How to ensure push order?
    • Theoretically, events for the same incident are pushed in chronological order, but retries may cause out-of-order delivery
    • Services can filter based on event_time; if a later event has been received, earlier events can be filtered out. Each push carries the latest complete information, so occasional event loss is tolerable
  2. Trusted IP whitelist for push source?
    • May be updated in the future, please check regularly