Alert routing rules

Add a routing rule to an integration

Adds a rule at the end of the evaluation order, but ALWAYS above the first catch-all — a rule that matches everything stops evaluation, so anything placed under it would never be tried. That is what makes it safe to create the integration first and build its routing table afterwards: the catch-all created with recipient_group_uuid sinks as you add rules. Among rules that are not catch-alls, order is order of creation; use the reorder endpoint to change it. A rule with no severities, no statuses and no label matchers matches everything and is itself a catch-all. The call is NOT idempotent: repeating it adds a second identical rule.

post/api/v1/observability/integrations/{integration}/routing-rules

Request

  • Base URL: https://wardenpoint.com (the document declares no server; this is the origin it was published from)
  • URL: https://wardenpoint.com/api/v1/observability/integrations/{integration}/routing-rules
  • Auth: API key in header X-API-Key

Path parameters

integrationstring uuid required

Integration UUID.

Request body

namestring nullable

Label for humans.

recipient_group_uuidstring uuid nullable

Group to notify when the rule matches. Must belong to the same company as the API key — a group UUID from anywhere else is refused with 422 rather than stored as "no group". Null mutes matching alerts on purpose.

target_kind'group' | 'event'

Who the rule pages: group (a recipient group you name) or event (the people the alert itself names — a GitLab merge request lists its reviewers). event is accepted only for sources that name people; every other source rejects it with 422. A rule with event takes no recipient_group_uuid.

addressee_set'all' | 'added' | 're_requested' | 'reviewed' nullable

Which of the people named by the event to page. Required when target_kind is event, otherwise null. all — every reviewer; added — only those this event added; re_requested — only those asked to review again; reviewed — only those who already looked at the diff. Anyone the event names but whose login is not bound to a recipient on the integration page is recorded there for binding, and an event where nobody is bound lands in the triage inbox with addressee_unresolved.

severitiesstring[] nullable

Empty or omitted means any severity.

statusesstring[] nullable

Empty or omitted means any status.

threshold_countinteger nullable

Occurrences needed to reach threshold_action, overriding the integration for alerts this rule matches. Omit to inherit — but read the note above about what "omit" means once any sibling is set.

window_minutesinteger nullable

Length of the counting window, overriding the integration. Falls back to 1 minute when the override block is engaged, which is short enough that a threshold above 1 is effectively never reached — set it deliberately.

below_threshold_action'suppress' | 'message' | 'escalate' nullable

Applied to occurrences before the threshold. Falls back to the integration's default action.

threshold_action'suppress' | 'message' | 'escalate' nullable

Applied to the occurrence that hits the threshold — this is the one that decides whether people are woken, and at which priority: escalate pages at critical and starts the escalation chain, message pages at normal and starts none, suppress records without notifying. Falls back to the integration's default action.

after_threshold_action'suppress' | 'message' | 'escalate' nullable

Applied to further occurrences in the same window. Falls back to suppress, not to the integration default — one incident pages once by design. That is also why leaving this out while setting a sibling can quietly mute a repeating alert for the rest of the window.

Example request

{
  "label_matchers": [
    {
      "key": "service",
      "value": "checkout"
    }
  ]
}

Response

Rule created.

Example response

{
  "data": {
    "label_matchers": [
      {
        "key": "service",
        "value": "checkout"
      }
    ]
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.