Webhook Variables

When you write the body of your custom webhook, you can include static or dynamic key/value pairs.
The “root” object is notification, but it should not be referenced in the template. For example, to access the notification ID, use {{ id }} as the expression.

Variables Included

Variable
Type
Description
id
Numeric
An identifier for the notification
type.id
Numeric
Clear (1) or Trigger (2)
alert.id
Numeric
An identifier for the alert
alert.severity.id
String
The severity of the alert
alert.firstSeen.epochSecond
Date/time string
The time when the alert triggered
alert.firstSeen.epochMilli
Date/time string
The time when the alert triggered
alert.timeCleared.epochSecond
Date/time string
The time when the alert cleared
alert.timeCleared.epochMilli
Date/time string
The time when the alert cleared
alert.rule.id
Numeric
An identifier for the alert rule
alert.rule.name
Numeric
Name of the alert rule
alert.rule.account.id
Numeric
An identifier for the account that owns the alert rule
alert.rule.account.organization.id
Numeric
An identifier for the organization that owns the alert rule
alert.rule.account.organization.timezone.id
String
An identifier for the organization’s time zone
alert.rule.expression
String
The machine-readable alert rule expression
alert.rule.notes
String
Alert rule notes
alert.rule.alertType.id
String
The alert rule’s alert type
The following variables are generic versions of concepts that might be called by other names depending on the alert type. For example, if the alerts are Cloud and Enterprise Agent alerts, details could refer to location alerts. If the alerts are BGP alerts, details might refer to monitors. Similarly, targets might refer to a URL or to a BGP prefix, for HTTP alerts or BGP alerts, respectively.
Variable
Type
Description
alert.details.size
Numeric
Number of alert detail objects, such as agents or monitors, that triggered during the alert
alert.targets.size
Numeric
The number of target objects, such as URLs or prefixes, involved in the alert. This value is usually 1, except for agent-to-agent alert rules

Collections

The variables in the table below are collections of elements, and must be accessed within a helper function that iterates over the members, such as with the each helper.
In cases where there is reasonable confidence that the collection will have exactly one element and you would like to display data from that single element, you can use syntax such as the following:
{{#unless alert.targets.size 0}}
"targets": "{{#each alert.targets}}{{description}}{{#unless @last}}, {{/unless}}{{/each}}"
{{/unless}}
This will cause the targetName field to be populated correctly when there is one target on the alert, but avoids any errors if there are zero targets or more than one target on the alert.
Variable
Type
Description
alert.details.metricsAtStart
String
The alert rule violations that triggered the alert
alert.details.metricsAtEnd
String
The value of the metric when the alert cleared, for the metrics that were in violation when the alert triggered
alert.details.source.id
Numeric
The identifier of the alert details' source. E.g., a VAgentID or MonitorID
alert.details.source.name
String
The name of the alert details' source
alert.details.asn.name
String
BGP only: The name of the AS associated with the source monitor
alert.targets.description
String
The name of the target
alert.test.labels.name
String
The name of the test label
Also note that all enumerations can be referenced by their ID, rather than their name. For example, the notification type can be referenced by 1 (for cleared notifications) or 2 (for triggered notifications), rather than the string “CLEAR” or “TRIGGER”, respectively. The advantage of doing this is that these underlying IDs will not change, whereas their names may change over time.

Helper Functions

The following helper functions are available to assist in templating. For a short tutorial on helper functions in the Handlebars framework, see the Handlebars guide.
  • and
  • each
  • eq
  • formatDate
  • formatExpression
  • gt
  • gte
  • if
  • lt
  • lte
  • neq
  • not
  • or
  • unless
  • with
The helper functions formatDate and formatExpression are custom-built for alert notifications. The first takes a time variable such as alert.firstSeen and formats it into “YYYY-MM-DD HH:MM:SS Z” format, where Z is a timezone. The default timezone is UTC. You can use your organization’s timezone with the expression {{ formatDate alert.firstSeen alert.rule.account.organization.timezone }}, or you can hardcode a timezone like this:
{{ formatDate alert.firstSeen “Americas/Los Angeles” }}
or
{{ formatDate alert.firstSeen “PST” }}
The formatExpression helper function converts a machine-readable alert rule expression such as ((responseTime > 100ms)) and translates it into a more human-readable format, such as Response Time > 100ms.