Opening a war room from a Buzz message

This page is about opening an incident automatically from Buzz: a reaction on a message, a keyword, or a workflow someone runs by hand. It is not about the Landfall agent inside Buzz or posting updates into a channel; for those see Connecting Buzz. The two are independent, and most teams eventually set up both.

How it works

A Buzz workflow is a small YAML definition attached to a channel. Its call_webhook action posts to an external URL with the fields Buzz exposes for the triggering message: the channel id, the message id, the author's public key, the text, the timestamp and, for a reaction trigger, the emoji. Landfall has a dedicated route for it, POST /triggers/buzz/<org-slug>, authenticated by a per-organization secret you issue in Landfall and send in a header. Buzz cannot sign requests, so the secret is the credential; it is separate from your ingest token and from every other provider's secret, and rotating it affects nothing else.

Each distinct Buzz message opens exactly one incident. If the workflow fires twice for the same message, the second delivery attaches to the incident that already exists instead of opening another. Landfall never posts back from this route; when the channel updates integration is connected, the war-room link arrives as a reply in the originating thread through that path.

What you'll need

• An admin seat on your Landfall organization, to issue the Buzz trigger secret.
• Owner or admin rights on the Buzz channel: saving a workflow that calls an external URL needs that authority.
• Buzz Desktop or the buzz CLI to create the workflow.

1. Issue the trigger secret

In Landfall, open Settings → Integrations → Buzz and press Issue trigger secret. It is shown once; Landfall keeps only a hash. Issuing again replaces it immediately.

2. Create the workflow in Buzz

The example below opens a war room when someone reacts with 🚨 to a message. Replace the slug and the secret, then save it on the channel.

name: "Open a Landfall war room"
trigger:
  on: reaction_added
  filter: "trigger.emoji == '🚨'"
steps:
  - id: open
    action: call_webhook
    url: "https://api.landfalls.ai/triggers/buzz/<org-slug>"
    method: POST
    headers:
      x-landfall-buzz-secret: "<secret from Landfall>"
      content-type: "application/json"
    body:
      channel_id: "{{trigger.channel_id}}"
      message_id: "{{trigger.message_id}}"
      author_pubkey: "{{trigger.author}}"
      text: "{{trigger.text}}"
      timestamp: "{{trigger.timestamp}}"
      emoji: "{{trigger.emoji}}"
      trigger: "reaction_added"

buzz workflows create --channel <channel-id> --yaml "$(cat workflow.yaml)"

For a keyword trigger use on: message_posted with a filter such as str_contains(trigger.text, 'P1') and set trigger: "message_posted" in the body. Only the fields above exist on Buzz's trigger; an unknown template variable is sent as literal text.

3. What Landfall does with it

• Opens an incident titled from the first line of the message, at severity 3 by default, or severity 2 when the text contains P1, sev1, outage or down; a severity proposal is recorded so a human decides.
• Records the message as the incident's first timeline entry with a link back to it in Buzz.
• Rejects any call without the secret, or with a wrong one, with a uniform response and an audit entry that does not reveal why.

Try it from a terminal

curl -sS -X POST "https://api.landfalls.ai/triggers/buzz/<org-slug>" \
  -H "x-landfall-buzz-secret: <secret>" \
  -H "content-type: application/json" \
  --data '{"channel_id":"<channel-id>","message_id":"<64-hex>","author_pubkey":"<64-hex>","text":"P1: checkout is down","timestamp":1757000000,"emoji":"🚨","trigger":"reaction_added"}'

The response names the outcome (opened the first time, attached when you repeat it) and the war-room URL.