Appearance
Incoming integrations
Exhale turns incoming alert signals into Pulses — scrubbed payloads in PostgreSQL, optional async triage, and the customer UI. Each source is an HTTPS webhook that creates or updates tenant-scoped pulse rows.
Today: PagerDuty, OpsGenie, Splunk On-Call, Grafana, Datadog, Alertmanager, New Relic, Sentry, Honeycomb, Elastic Observability, Dynatrace, AWS CloudWatch, and tenant manual webhooks are production ingest paths.
Triage context (repos, runbooks, observability at triage time) is separate from ingest — configure under Connections → Context in the app.
Outbound notifications (Slack Block Kit, Teams Adaptive Cards, outbound HTTPS webhook, incident email/SMS after triage) are separate from ingest — configure under Connections → Notifications.
How ingest works (all sources)
Every incoming integration follows the same pipeline:
- Authenticate — vendor signature, shared secret, or tenant token (per source).
- Size limit — reject bodies over the configured maximum (default 1 MiB → 413).
- Dedupe — delivery id and/or
(tenant_id, source, external_id)to avoid duplicate Pulses. - Scrub — regex + structural masking before persist and before LLM.
- Resolve tenant — integration registry account hint; dev tenant fallback in local/test only.
- Upsert pulse — set
source,external_id, title, status, ephemeralpayload. - Enqueue triage — when async triage is enabled and lifecycle rules allow.
Shipped today
| Source | Endpoint | Pulse source | Guide |
|---|---|---|---|
| PagerDuty | POST /webhooks/pagerduty | pagerduty | PagerDuty webhooks |
| OpsGenie | POST /webhooks/opsgenie (header X-Exhale-Webhook-Token) or POST /webhooks/opsgenie/{token} | opsgenie | OpsGenie |
| Splunk On-Call | POST /webhooks/splunk-oncall (header X-Exhale-Webhook-Token) or POST /webhooks/splunk-oncall/{token} | splunk_oncall | Splunk On-Call |
| Grafana | POST /webhooks/grafana (header X-Exhale-Webhook-Token) or POST /webhooks/grafana/{token} | grafana | Grafana |
| Datadog | POST /webhooks/datadog (header X-Exhale-Webhook-Token) or POST /webhooks/datadog/{token} | datadog | Datadog |
| Prometheus Alertmanager | POST /webhooks/alertmanager (header X-Exhale-Webhook-Token) or POST /webhooks/alertmanager/{token} | alertmanager | Alertmanager |
| New Relic | POST /webhooks/newrelic (header X-Exhale-Webhook-Token) or POST /webhooks/newrelic/{token} | new_relic | New Relic |
| Sentry | POST /webhooks/sentry (header X-Exhale-Webhook-Token) or POST /webhooks/sentry/{token} | sentry | Sentry |
| Honeycomb | POST /webhooks/honeycomb (header X-Exhale-Webhook-Token) or POST /webhooks/honeycomb/{token} | honeycomb | Honeycomb |
| Elastic Observability | POST /webhooks/elastic (header X-Exhale-Webhook-Token) or POST /webhooks/elastic/{token} | elastic | Elastic |
| Dynatrace | POST /webhooks/dynatrace (header X-Exhale-Webhook-Token) or POST /webhooks/dynatrace/{token} | dynatrace | Dynatrace |
| AWS CloudWatch | POST /webhooks/aws-cloudwatch (header X-Exhale-Webhook-Token) or POST /webhooks/aws-cloudwatch/{token} | aws_cloudwatch | AWS CloudWatch |
| Manual webhook | POST /webhooks/manual (header X-Exhale-Webhook-Token) or POST /webhooks/manual/{token} | other (UI: Manual webhook) | Manual webhook |
Customer setup: Connections → Integrations. PagerDuty uses self-serve account id registration plus a shared webhook URL. Token-auth sources use a per-tenant URL token from Connect (manual also uses HMAC).
Context vs ingest
| Track | Purpose | Examples |
|---|---|---|
| Incoming (this site) | Creates Pulses | New Relic Integrations, Datadog Integrations, Sentry, CloudWatch SNS, … |
| Context (in-app) | Enrichment at triage time | Datadog Context (API key); New Relic Context and other Observability context adapters (connect shipped; APM fetch at triage still open) |
OpenAPI
Webhook and integration-setup routes are documented in the API reference. Use the guides above for signing, dedupe, tenancy, and lifecycle behavior.