---
title: "Create an alert source"
method: POST
path: "/alert-sources"
tags: ["Alert sources"]
---

# Create an alert source

`POST /alert-sources`

## Request

- Base URL: `https://api.spectate.net/v1`
- URL: `https://api.spectate.net/v1/alert-sources`
- Auth: HTTP bearer

Returns the source with its `webhook_url` (and `email_address` for `email`) to set up in the
tool. Email sources resolve alerts after an hour without a repeat unless
`auto_resolve_minutes` says otherwise: mail has no "resolved".

## Request body

- CreateAlertSource: A new alert source. The response has the `webhook_url` (and `email_address`) to configure in the tool.
  - `name` string, required: Name shown on its alerts, up to 255 characters
  - `type` 'webhook' | 'email' | 'alertmanager' | 'grafana' | 'sentry', required: The external tool behind an alert source; decides how its requests are read. | | |---| | `webhook` <br/> Spectate's own JSON format, for scripts, CI and anything that can call a URL. | | `email` <br/> Emails to the source's own address (subject becomes the alert). | | `alertmanager` <br/> Prometheus Alertmanager `webhook_configs`. | | `grafana` <br/> Grafana Alerting webhook contact point (Alertmanager format plus Grafana links). | | `sentry` <br/> Sentry internal integration webhooks (SaaS and self-hosted), or the legacy WebHooks plugin. |
  - `default_severity` 'critical' | 'high' | 'medium' | 'low': How urgent an alert or incident is. Escalation paths can branch on it. | | |---| | `critical` <br/> Customers are affected right now. | | `high` <br/> Serious, needs attention soon. | | `medium` <br/> Should be looked at. | | `low` <br/> Informational. |
  - `auto_resolve_minutes` integer, nullable: Minutes, 5 to 10080, after which an alert the tool stopped repeating resolves; `null` keeps it until resolved. Default `null`, or 60 for `email` sources
  - `secret` string, nullable: Signing secret the tool uses: Sentry client secret, Grafana HMAC secret or Alertmanager bearer token. Write-only
  - `settings` AlertSourceSettingsInput: Settings to set; settings you leave out keep their value.
    - `alert_on_new_issues` boolean: Sentry: also alert on every new issue
    - `signature_header` string, nullable: Grafana: the header carrying the HMAC signature, up to 100 characters; `null` for the default
    - `timestamp_header` string, nullable: Grafana: the timestamp header, when the contact point signs `{timestamp}:{body}`; `null` for none
  - `project_id` string, uuid, nullable: Project whose escalation paths apply when the source has none of its own
  - `escalation_path_ids` string[]: Escalation paths for the source's alerts

## Response `201`

The new alert source.

- AlertSource: An alert source: an external tool (Prometheus Alertmanager, Grafana, Sentry, a script…) whose requests to `webhook_url`, or mails to `email_address`, fire and resolve alerts. The URL and address contain the source's secret token: whoever has them can fire alerts.
  - `id` string, uuid, required: Alert source ID
  - `name` string, required: Name shown on its alerts
  - `type` 'webhook' | 'email' | 'alertmanager' | 'grafana' | 'sentry', required: The external tool behind an alert source; decides how its requests are read. | | |---| | `webhook` <br/> Spectate's own JSON format, for scripts, CI and anything that can call a URL. | | `email` <br/> Emails to the source's own address (subject becomes the alert). | | `alertmanager` <br/> Prometheus Alertmanager `webhook_configs`. | | `grafana` <br/> Grafana Alerting webhook contact point (Alertmanager format plus Grafana links). | | `sentry` <br/> Sentry internal integration webhooks (SaaS and self-hosted), or the legacy WebHooks plugin. |
  - `enabled` boolean, required: Whether requests fire alerts; a disabled source rejects them
  - `webhook_url` string, uri, required: Where the tool sends its webhooks. Secret: rotate it with `rotateAlertSourceToken` if it leaks
  - `email_address` string, email, nullable, required: `email` sources: the address to send mails to. Secret like the URL
  - `has_secret` boolean, required: Whether a signing secret is set (Sentry client secret, Grafana HMAC secret, Alertmanager bearer token); it's never returned
  - `default_severity` 'critical' | 'high' | 'medium' | 'low', required: How urgent an alert or incident is. Escalation paths can branch on it. | | |---| | `critical` <br/> Customers are affected right now. | | `high` <br/> Serious, needs attention soon. | | `medium` <br/> Should be looked at. | | `low` <br/> Informational. |
  - `auto_resolve_minutes` integer, nullable, required: Minutes after which an alert the tool stopped repeating resolves; `null` keeps it until the tool resolves it
  - `settings` AlertSourceSettings, required: Settings of some source types; the others ignore them.
    - `alert_on_new_issues` boolean, nullable, required: Sentry: also alert on every new issue (issue `created` webhooks), not only on alert rules
    - `signature_header` string, nullable, required: Grafana: the header carrying the HMAC signature; `null` means `X-Grafana-Alerting-Signature`
    - `timestamp_header` string, nullable, required: Grafana: the timestamp header, when the contact point signs `{timestamp}:{body}`
  - `project_id` string, uuid, nullable, required: The project whose escalation paths apply when the source has none of its own; `null` for none
  - `escalation_paths` EscalationPathReference[], required: Escalation paths the source's alerts follow. Empty: the project's paths, else the team's default path
    - `id` string, uuid, required: Escalation path ID
    - `name` string, required: Escalation path name
  - `last_event_at` string, date-time, nullable, required: When the source last received a request
  - `events_count` integer, required: Requests the source has received in total
  - `firing_alerts_count` integer, required: Alerts of the source that are firing now
  - `created_at` string, date-time, required: When the source was created

## Other responses

- `401`: `UNAUTHENTICATED`: no token was sent. `INVALID_TOKEN`: the token is unknown or revoked. `TOKEN_EXPIRED`: the token has expired.
- `403`: `FORBIDDEN`: the token lacks an ability this endpoint requires (listed in `details.required_abilities`). `TEAM_PENDING_DELETION`: the team is scheduled for deletion. `TEAM_SUSPENDED`: Spectate suspended the team.
- `422`: `VALIDATION_FAILED`: the request is invalid; `details.errors` lists the fields.
- `429`: `RATE_LIMITED`: too many requests for this token. Wait for the number of seconds in `Retry-After`.

---

[API](https://skmtc.dev/spectate/apis/spectate-api.md) - [All operations](https://skmtc.dev/spectate/apis/spectate-api/llms.txt) - [OpenAPI document](https://skmtc.dev/spectate/apis/spectate-api/revisions/9b1a233997de?raw)