Event Examples

Overview

This page provides real-world examples of event payloads that Edge Connectors receive when polling the Rootly API. These examples show the structure and data available for templating in your action configurations.

Event Types

Edge Connector events are divided into two categories based on how actions are triggered:

Understanding Action Types: Automatic events trigger actions automatically (configured in on: section), while manual trigger events are user-initiated actions (configured in callable: section). See the Automatic vs Callable Actions guide for detailed comparison.

Automatic Event Types

These events are triggered automatically by system events and can be subscribed to by connectors for monitoring and notifications: Alert Events:

alert.created - New alert from monitoring system
alert.updated - Alert properties changed
alert.acknowledged - Alert acknowledged by a user
alert.resolved - Alert marked as resolved
alert.deleted - Alert removed

Incident Events:

incident.created - New incident started
incident.updated - Incident properties changed
incident.in_triage - Incident moved to triage status
incident.mitigated - Incident mitigated
incident.resolved - Incident marked resolved
incident.cancelled - Incident cancelled
incident.deleted - Incident deleted

Manual Trigger Event Types

These events are triggered by user actions and are managed by actions’ event_types_trigger field, not connector subscriptions:

action.triggered - Standalone action triggered by a user
alert.action_triggered - Action triggered from an alert context
incident.action_triggered - Action triggered from an incident context

Automatic events can be subscribed to when configuring your Edge Connector. Manual trigger events are configured per action and execute when users trigger them from the UI.

Event Payload Examples

Below are detailed examples of event payloads for each event type.

alert.created - Production Database Alert

{
  "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "event_id": "a3bb189e-8bf9-3888-9912-ace4e6543002",
  "event_type": "alert.created",
  "timestamp": "2025-10-26T21:30:00Z",
  "data": {
    "id": "6aeb35ae-ca31-4bcf-91bd-c4ecce44dedc",
    "source": "datadog",
    "summary": "High database latency detected",
    "status": "open",
    "labels": {
      "severity": "critical",
      "component": "database",
      "region": "us-west-2"
    },
    "data": {
      "host": "prod-db-01.example.com",
      "latency_ms": 1500,
      "threshold_ms": 500,
      "query_count": 342
    },
    "started_at": "2025-10-26T21:29:45Z",
    "ended_at": null,
    "created_at": "2025-10-26T21:29:50Z",
    "updated_at": "2025-10-26T21:29:50Z",
    "services": [
      {
        "id": "8e3f9c2a-1d5b-4e8f-9a3c-7b2d4e6f8a1c",
        "name": "DB - Production Database",
        "slug": "db-production"
      }
    ],
    "environments": [
      {
        "id": "2c4e6a8b-3f5d-4a7c-8b9e-1f3a5c7d9e2b",
        "name": "Production",
        "slug": "production",
        "color": "#E74C3C"
      }
    ]
  }
}

Template Usage

parameters:
  alert_id: "{{ id }}"
  alert_summary: "{{ summary }}"
  severity: "{{ labels.severity }}"
  host: "{{ data.host }}"
  latency: "{{ data.latency_ms }}"
  service_name: "{{ services.0.name }}"      # First service
  environment: "{{ environments.0.slug }}"   # First environment

alert.created - PagerDuty Integration

{
  "id": "9d4e2f1c-7a8b-4c3d-9e5f-6a7b8c9d0e1f",
  "event_id": "5c6d7e8f-9a0b-4c5d-8e9f-0a1b2c3d4e5f",
  "event_type": "alert.created",
  "timestamp": "2025-10-26T21:35:00Z",
  "data": {
    "id": "b8c9d0e1-f2a3-4b5c-6d7e-8f9a0b1c2d3e",
    "source": "pagerduty",
    "summary": "API service is down",
    "status": "open",
    "labels": {
      "severity": "high",
      "urgency": "high",
      "impact": "critical"
    },
    "data": {
      "incident_key": "PD-12345",
      "incident_url": "https://example.pagerduty.com/incidents/12345",
      "triggered_by": "monitoring_service",
      "escalation_policy": "Engineering On-Call"
    },
    "started_at": "2025-10-26T21:34:30Z",
    "ended_at": null,
    "created_at": "2025-10-26T21:34:35Z",
    "updated_at": "2025-10-26T21:34:35Z",
    "services": [
      {
        "id": "3f4e5d6c-7b8a-4c9d-0e1f-2a3b4c5d6e7f",
        "name": "API Gateway",
        "slug": "api-gateway"
      },
      {
        "id": "8a9b0c1d-2e3f-4a5b-6c7d-8e9f0a1b2c3d",
        "name": "Authentication Service",
        "slug": "auth-service"
      }
    ],
    "environments": [
      {
        "id": "1e2f3a4b-5c6d-7e8f-9a0b-1c2d3e4f5a6b",
        "name": "Production",
        "slug": "production",
        "color": "#E74C3C"
      }
    ]
  }
}

Template Usage

parameters:
  pagerduty_key: "{{ data.incident_key }}"
  pagerduty_url: "{{ data.incident_url }}"
  urgency: "{{ labels.urgency }}"
  all_services: "{{ services | join:', ' }}"  # "API Gateway, Authentication Service"

alert.updated - Status Change

{
  "id": "4d5e6f7a-8b9c-0d1e-2f3a-4b5c6d7e8f9a",
  "event_id": "7e8f9a0b-1c2d-3e4f-5a6b-7c8d9e0f1a2b",
  "event_type": "alert.updated",
  "timestamp": "2025-10-26T22:00:00Z",
  "data": {
    "id": "6aeb35ae-ca31-4bcf-91bd-c4ecce44dedc",
    "source": "datadog",
    "summary": "High database latency detected",
    "status": "resolved",
    "labels": {
      "severity": "critical",
      "component": "database"
    },
    "data": {
      "host": "prod-db-01.example.com",
      "latency_ms": 150,
      "resolution": "auto-scaled database pool"
    },
    "started_at": "2025-10-26T21:29:45Z",
    "ended_at": "2025-10-26T21:59:30Z",
    "created_at": "2025-10-26T21:29:50Z",
    "updated_at": "2025-10-26T22:00:00Z",
    "services": [
      {
        "id": "8e3f9c2a-1d5b-4e8f-9a3c-7b2d4e6f8a1c",
        "name": "DB - Production Database",
        "slug": "db-production"
      }
    ],
    "environments": [
      {
        "id": "2c4e6a8b-3f5d-4a7c-8b9e-1f3a5c7d9e2b",
        "name": "Production",
        "slug": "production",
        "color": "#E74C3C"
      }
    ]
  }
}

incident.created - Full Example

Based on EdgeConnectors::IncidentSerializer:

{
  "id": "c1d2e3f4-a5b6-7c8d-9e0f-1a2b3c4d5e6f",
  "event_id": "2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e",
  "event_type": "incident.created",
  "timestamp": "2025-10-26T23:00:00Z",
  "data": {
    "id": "9f8e7d6c-5b4a-3210-fedc-ba9876543210",
    "sequential_id": 42,
    "title": "Production API Gateway Outage",
    "slug": "production-api-gateway-outage",
    "summary": "Complete outage affecting all customers",
    "status": "started",
    "kind": "normal",
    "private": false,
    "detected_at": "2025-10-26T22:58:00Z",
    "acknowledged_at": null,
    "started_at": "2025-10-26T22:58:00Z",
    "mitigated_at": null,
    "resolved_at": null,
    "cancelled_at": null,
    "created_at": "2025-10-26T22:59:00Z",
    "updated_at": "2025-10-26T23:00:00Z",
    "services": [
      {
        "id": "3f4e5d6c-7b8a-4c9d-0e1f-2a3b4c5d6e7f",
        "name": "API Gateway",
        "slug": "api-gateway"
      }
    ],
    "environments": [
      {
        "id": "1e2f3a4b-5c6d-7e8f-9a0b-1c2d3e4f5a6b",
        "name": "Production",
        "slug": "production",
        "color": "#E74C3C"
      }
    ],
    "functionalities": [
      {
        "id": "a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d",
        "name": "API Requests",
        "slug": "api-requests"
      }
    ],
    "severity": {
      "id": "5e4d3c2b-1a09-8f7e-6d5c-4b3a2910fedc",
      "name": "SEV1",
      "slug": "sev1",
      "color": "#FF0000"
    }
  }
}

alert.action_triggered - User-Initiated Restart on Alert

{
  "id": "e6f7a8b9-c0d1-2e3f-4a5b-6c7d8e9f0a1b",
  "event_id": "d5e6f7a8-b9c0-1d2e-3f4a-5b6c7d8e9f0a",
  "event_type": "alert.action_triggered",
  "timestamp": "2025-10-26T23:15:00Z",
  "action": {
    "id": "7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d",
    "name": "Restart Test Service",
    "slug": "restart_test_service"
  },
  "data": {
    "entity_id": "f0a1b2c3-d4e5-6f7a-8b9c-0d1e2f3a4b5c",
    "parameters": {
      "service_name": "api-gateway",
      "environment": "production",
      "force_restart": true,
      "drain_timeout": 30
    },
    "triggered_by": {
      "id": 50,
      "name": "Quentin Rousseau",
      "email": "quentin@rootly.com"
    }
  }
}

Template Usage in Actions

# Script action for alert actions
- name: restart_test_service
  type: script
  script: /opt/scripts/restart-service.sh
  trigger:
    event_type: "alert.action_triggered"

  parameters:
    # Action metadata (from top-level action object)
    action_display_name: "{{ action.name }}"  # "Restart Test Service"
    action_slug: "{{ action.slug }}"          # "restart_test_service"

    # User inputs (from UI)
    service_name: "{{ parameters.service_name }}"
    environment: "{{ parameters.environment }}"
    force: "{{ parameters.force_restart }}"

    # Context data
    entity_id: "{{ entity_id }}"
    triggered_by_email: "{{ triggered_by.email }}"

    # Hardcoded
    region: "us-west-2"
    timeout: "60"

incident.action_triggered - Escalation on Incident

{
  "id": "b9c0d1e2-f3a4-5b6c-7d8e-9f0a1b2c3d4e",
  "event_id": "a8b9c0d1-e2f3-4a5b-6c7d-8e9f0a1b2c3d",
  "event_type": "incident.action_triggered",
  "timestamp": "2025-10-26T23:20:00Z",
  "action": {
    "id": "6c7d8e9f-0a1b-2c3d-4e5f-6a7b8c9d0e1f",
    "name": "Scale Infrastructure",
    "slug": "scale_infrastructure"
  },
  "data": {
    "entity_id": "d4e5f6a7-b8c9-0d1e-2f3a-4b5c6d7e8f9a",
    "parameters": {
      "target_capacity": 200,
      "scaling_policy": "aggressive"
    },
    "triggered_by": {
      "id": 42,
      "name": "Sarah Johnson",
      "email": "sarah@example.com"
    }
  }
}

action.triggered - Standalone Action

{
  "id": "c3d4e5f6-a7b8-9c0d-1e2f-3a4b5c6d7e8f",
  "event_id": "b2c3d4e5-f6a7-8b9c-0d1e-2f3a4b5c6d7e",
  "event_type": "action.triggered",
  "timestamp": "2025-10-26T23:25:00Z",
  "action": {
    "id": "5f6a7b8c-9d0e-1f2a-3b4c-5d6e7f8a9b0c",
    "name": "Clear Global Cache",
    "slug": "clear_global_cache"
  },
  "data": {
    "parameters": {
      "cache_type": "redis",
      "scope": "global"
    },
    "triggered_by": {
      "id": 50,
      "name": "Quentin Rousseau",
      "email": "quentin@rootly.com"
    }
    // No entity_id - this is a standalone action
  }
}

Edge Cases

Alert with No Services

{
  "event_type": "alert.created",
  "data": {
    "id": "e9f0a1b2-c3d4-5e6f-7a8b-9c0d1e2f3a4b",
    "summary": "Orphaned alert",
    "status": "open",
    "services": [],        // ← Empty array
    "environments": []     // ← Empty array
  }
}

Alert with Custom Data (Datadog)

{
  "event_type": "alert.created",
  "data": {
    "id": "d8e9f0a1-b2c3-4d5e-6f7a-8b9c0d1e2f3a",
    "source": "datadog",
    "summary": "CPU usage above 90%",
    "status": "open",
    "data": {
      "tags": ["env:production", "service:api", "host:prod-01"],
      "metric": "system.cpu.usage",
      "value": 94.2,
      "threshold": 90.0,
      "monitor_id": "12345678",
      "monitor_name": "High CPU Usage"
    }
  }
}

Standalone Action with No Parameters

{
  "event_type": "action.triggered",
  "action": {
    "id": "c7d8e9f0-a1b2-3c4d-5e6f-7a8b9c0d1e2f",
    "name": "Clear Cache",
    "slug": "clear_cache"
  },
  "data": {
    "parameters": {},      // ← No user inputs required
    "triggered_by": {
      "id": 50,
      "name": "Quentin Rousseau",
      "email": "quentin@rootly.com"
    }
    // No entity_id - standalone action
  }
}

HTTP Action Examples

alert.created → Slack Notification

- name: notify_slack_alert
  type: http
  trigger:
    event_type: "alert.created"
  http:
    url: "{{ env.SLACK_WEBHOOK_URL }}"
    method: POST
    headers:
      Content-Type: "application/json"
    body: |
      {
        "text": ":warning: New Alert",
        "attachments": [{
          "color": "danger",
          "fields": [
            {"title": "Summary", "value": "{{ summary }}", "short": false},
            {"title": "Source", "value": "{{ source }}", "short": true},
            {"title": "Severity", "value": "{{ labels.severity }}", "short": true},
            {"title": "Host", "value": "{{ data.host }}", "short": true},
            {"title": "Environment", "value": "{{ environments.0.name }}", "short": true}
          ]
        }]
      }
  timeout: 10

incident.created → PagerDuty Integration

- name: create_pagerduty_incident
  type: http
  trigger:
    event_type: "incident.created"
  http:
    url: "https://api.pagerduty.com/incidents"
    method: POST
    headers:
      Authorization: "Token token={{ env.PAGERDUTY_TOKEN }}"
      Content-Type: "application/json"
      From: "{{ env.PAGERDUTY_FROM_EMAIL }}"
    body: |
      {
        "incident": {
          "type": "incident",
          "title": "[{{ severity.name }}] {{ title }}",
          "service": {
            "id": "{{ env.PAGERDUTY_SERVICE_ID }}",
            "type": "service_reference"
          },
          "urgency": "high",
          "body": {
            "type": "incident_body",
            "details": "{{ summary }}\n\nAffected services: {{ services.0.name }}"
          }
        }
      }
  timeout: 15

alert.action_triggered → Restart Service API

- name: restart_service_api
  type: http
  trigger:
    event_type: "alert.action_triggered"
    action_name: "restart_service_api"
  parameter_definitions:
    - name: service_name
      type: string
      required: true
    - name: force_restart
      type: boolean
      default: false
  http:
    url: "https://api.example.com/v1/services/{{ parameters.service_name }}/restart"
    method: POST
    headers:
      Authorization: "Bearer {{ env.API_TOKEN }}"
      Content-Type: "application/json"
      X-Triggered-By: "{{ triggered_by.email }}"
    body: |
      {
        "force": {{ parameters.force_restart }},
        "reason": "Manual restart via Rootly",
        "alert_id": "{{ entity_id }}"
      }
  timeout: 60

action.triggered → Clear Global Cache

- name: clear_cache_http
  type: http
  trigger:
    event_type: "action.triggered"
    action_name: "clear_cache_http"
  parameter_definitions:
    - name: cache_type
      type: string
      options: ["redis", "memcached", "all"]
      required: true
  http:
    url: "https://cache-api.example.com/v1/clear"
    method: POST
    headers:
      X-API-Key: "{{ env.CACHE_API_KEY }}"
    params:
      type: "{{ parameters.cache_type }}"
    body: |
      {
        "triggered_by": "{{ triggered_by.email }}",
        "scope": "global"
      }
  timeout: 30

HTTP Action Behavior:

Exit code = HTTP status code (200, 404, 500, etc.)
Stdout = Response body + status message
Stderr = Error message (if request fails)
Success = 2xx status codes
Failure = 4xx, 5xx status codes

Template Access Patterns

Simple Fields

alert_id: "{{ id }}"
status: "{{ status }}"
summary: "{{ summary }}"

Nested Objects

severity: "{{ labels.severity }}"
host: "{{ data.host }}"
metric_value: "{{ data.value }}"

Arrays (First Element)

service_name: "{{ services.0.name }}"
service_slug: "{{ services.0.slug }}"
environment: "{{ environments.0.slug }}"

Environment Variables

api_key: "{{ env.DATADOG_API_KEY }}"
region: "{{ env.AWS_REGION }}"

Mixed

message: "[{{ labels.severity }}] {{ summary }} on {{ data.host }} in {{ environments.0.name }}"
# Result: "[critical] High database latency detected on prod-db-01.example.com in Production"

Testing Locally

Create a test event payload file:

# test-alert.json
{
  "events": [{
    "id": "b6c7d8e9-f0a1-2b3c-4d5e-6f7a8b9c0d1e",
    "event_id": "a5b6c7d8-e9f0-1a2b-3c4d-5e6f7a8b9c0d",
    "event_type": "alert.created",
    "timestamp": "2025-10-26T23:00:00Z",
    "data": {
      "id": "9e0f1a2b-3c4d-5e6f-7a8b-9c0d1e2f3a4b",
      "source": "test",
      "summary": "Test alert for local development",
      "status": "open",
      "labels": {"severity": "critical"},
      "data": {"host": "localhost"},
      "services": [{"id": "8d9e0f1a-2b3c-4d5e-6f7a-8b9c0d1e2f3a", "name": "Test Service", "slug": "test"}],
      "environments": [{"id": "7c8d9e0f-1a2b-3c4d-5e6f-7a8b9c0d1e2f", "name": "Development", "slug": "dev"}]
    }
  }]
}

Then post to your local mock server to trigger actions.

​Overview

​Event Types

​Automatic Event Types

​Manual Trigger Event Types

​Event Payload Examples

​alert.created - Production Database Alert

​Template Usage

​alert.created - PagerDuty Integration

​Template Usage

​alert.updated - Status Change

​incident.created - Full Example

​alert.action_triggered - User-Initiated Restart on Alert

​Template Usage in Actions

​incident.action_triggered - Escalation on Incident

​action.triggered - Standalone Action

​Edge Cases

​Alert with No Services

​Alert with Custom Data (Datadog)

​Standalone Action with No Parameters

​HTTP Action Examples

​alert.created → Slack Notification

​incident.created → PagerDuty Integration

​alert.action_triggered → Restart Service API

​action.triggered → Clear Global Cache

​Template Access Patterns

​Simple Fields

​Nested Objects

​Arrays (First Element)

​Environment Variables

​Mixed

​Testing Locally

Overview

Event Types

Automatic Event Types

Manual Trigger Event Types

Event Payload Examples

alert.created - Production Database Alert

Template Usage

alert.created - PagerDuty Integration

Template Usage

alert.updated - Status Change

incident.created - Full Example

alert.action_triggered - User-Initiated Restart on Alert

Template Usage in Actions

incident.action_triggered - Escalation on Incident

action.triggered - Standalone Action

Edge Cases

Alert with No Services

Alert with Custom Data (Datadog)

Standalone Action with No Parameters

HTTP Action Examples

alert.created → Slack Notification

incident.created → PagerDuty Integration

alert.action_triggered → Restart Service API

action.triggered → Clear Global Cache

Template Access Patterns

Simple Fields

Nested Objects

Arrays (First Element)

Environment Variables

Mixed

Testing Locally