Alerts and tickets
Alerts and tickets from other tools open incidents in Awaiting fix. When a pull request that mentions the incident (for example "Fixes INC-16") merges, time travel starts.
Every source posts to APP_URL/api/webhooks/<source>?workspace=<login>. The exact URL is shown under Integrations for each source.
Sources
| Source | Path | Authentication | Taken | Mapped by |
|---|---|---|---|---|
| Sentry | sentry | sentry-hook-signature HMAC; secret from Sentry | New issues | Project slug |
| PagerDuty | pagerduty | X-PagerDuty-Signature HMAC; secret from PagerDuty | incident.triggered, incident.resolved | Service |
| incident.io | incidentio | Standard Webhooks; secret (whsec_…) from incident.io | Incident created and status updated (v2) | Incident type |
| Linear | linear | Linear-Signature HMAC plus webhookTimestamp; secret from Linear | Issues labelled incident | Team key |
| Rootly | rootly | Token | incident.created, incident.mitigated, incident.resolved | First service |
| Opsgenie | opsgenie | Token | Create and Close alert actions | Entity |
| Datadog | datadog | Token | Triggered and re-triggered monitors | service: tag |
| Jira | jira | Token | Created or updated issues of type Bug or Incident, or labelled incident | Project key |
| Generic webhook | webhook | Standard Webhooks; secret generated by Aftershock | incident.* events | service |
Sentry and PagerDuty are on for everyone. The others are in Settings → Labs ("incident.io, Rootly, Opsgenie, Datadog, Linear, Jira and generic webhooks") while they are in beta. With the flag off, their endpoints answer 404.
Connecting a source
- Open Integrations and pick the source.
- Set up the secret:
- Sentry, PagerDuty, incident.io, Linear create their own signing secret. Copy it from the provider and use Save signing secret.
- Generic webhook and the token sources: Generate signing secret or Generate token. It is shown once.
- Paste the webhook URL into the provider.
- Map provider names to repositories, for example
checkout:ecommerce-api, web:storefront-web. An unmapped alert goes to the repository with the same name, or to your only repository. - Send test delivery signs a harmless ping with the stored secret and runs it through the real endpoint.
Token sources
Rootly, Opsgenie, Datadog and Jira don't publish a signing scheme Aftershock can verify, so they use a per-workspace token. Send it in one of these ways, best first:
Authorization: Bearer <token>X-Aftershock-Token: <token>&token=<token>on the URL, only for tools that can't set headers. URLs end up in proxy and provider logs, so rotate the token if one leaks.
Datadog payload
In Integrations → Webhooks, use this payload and mention @webhook-<name> in a monitor:
{"id":"$AGGREG_KEY","title":"$EVENT_TITLE","message":"$EVENT_MSG","transition":"$ALERT_TRANSITION","link":"$LINK","tags":"$TAGS"}Jira
Use an Automation rule: Issue created → Send web request to the URL, method POST, with the token header and the web request body "Issue data (Jira format)". Native Jira webhooks work too if your Jira can add a header.
Generic webhook
Sign with Standard Webhooks (webhook-id, webhook-timestamp, webhook-signature) using the generated secret:
{ "type": "incident.created", "data": { "id": "evt-42", "title": "Invoices sent twice", "description": "Retry ran after success", "service": "billing", "url": "https://status.example.com/42" } }Safety
- Signatures and tokens are compared in constant time before the body is parsed.
- Signed timestamps (Standard Webhooks, Linear) must be within five minutes of now, so captured deliveries can't be replayed later.
- Bodies over 256 KiB are refused.
- Each source is rate limited per sender.
- The same alert (by provider id) never opens a second incident.
- Unknown workspaces, unknown sources and sources switched off all answer the same 404.
- Links from payloads are kept only if they are
http(s).