Opening a war room from an Opsgenie alert

An Opsgenie Webhook integration posts each alert action to Landfall. A Create opens a war room, or attaches to the open one for the same alert; Acknowledge and Close are recorded on that room. This page is not about the API key; see Connecting Opsgenie. The two are independent.

How it works

Opsgenie posts to https://api.landfalls.ai/triggers/opsgenie, one URL for every organization. Each delivery carries your organization's webhook secret in the x-landfall-opsgenie-secret header. Landfall keeps only the secret's SHA-256 hash and finds your organization from it; nothing in the body decides the organization.

Landfall reads the body's action and alert.alertId. It acts on Create, Acknowledge and Close and accepts every other action without doing anything. Every follow-up attaches by the Opsgenie alert id.

What you'll need

• An admin on your Landfall organization, to issue the secret.
• An Opsgenie account that can add a Webhook integration.
• curl and jq for step 1.

1. Issue a webhook secret

There is no button for this yet, so an admin issues it with one API call. The secret is shown once; Landfall keeps only its hash. Issuing again replaces it, and the old secret stops working at once.

SESSION=$(curl -s -X POST https://api.landfalls.ai/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"<you>","password":"<your password>","orgSlug":"<your-org-slug>"}' \
  | jq -r .accessToken)

curl -X POST https://api.landfalls.ai/o/<your-org-slug>/triggers/opsgenie-secret \
  -H "Authorization: Bearer $SESSION"

The answer is {"secret":"<64 hex characters>"}. Keep it for the next step.

2. Point Opsgenie at Landfall

In Opsgenie, open Settings → Integrations → Add integration → Webhook and point it at Landfall with the secret as a custom header:

What each action does

What Opsgenie's fields become

3. Test it

Post a Create the way Opsgenie would:

curl -i -X POST https://api.landfalls.ai/triggers/opsgenie \
  -H "x-landfall-opsgenie-secret: <your secret>" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "Create",
    "alert": {
      "alertId": "a1b2c3d4-0000-4000-8000-000000000000",
      "message": "Checkout latency above SLO",
      "priority": "P2",
      "source": "acme-monitoring",
      "tags": ["service:checkout"]
    }
  }'

The answer is 202 with {"outcome":"opened","incidentId":"<id>"}. The room is titled Checkout latency above SLO at sev2 and appears in your Incidents list with an Opsgenie source badge. Send the same body again and the outcome is attached, with the same incident id.

Repeats and recovery

• Attach identity: the Opsgenie alert id. A Create for an alert whose room is still open attaches to it and writes nothing.
• Fires again later: a Create for an alert whose room is no longer open opens a new room.
• Acknowledge: recorded on the alert's room. One for an alert that never opened a room is accepted and recorded in the audit log as opsgenie.action.ignored.
• Maintenance windows: a Create that matches an active maintenance window opens no room.
• Recovery: a Close is recorded as opsgenie.alert.closed and the room stays open until a person closes it.

Troubleshooting

Reference

See Integrations architecture for how every trigger source shares one pipeline.