Opening a war room from a Sentry alert

A Sentry issue alert can open a Landfall incident when its delivery reaches Landfall's shared trigger endpoint. It is not about reading telemetry; see Connecting Sentry. The two are independent.

How it works

Sentry deliveries go to the same endpoint as Datadog, Coralogix and CloudWatch, POST https://api.landfalls.ai/triggers, authenticated by your organization's ingest token in an Authorization: Bearer header. The token decides the organization, so there is one URL and one token for every source on this endpoint.

There is no template to write. Landfall recognizes Sentry by the shape of the body: an event_id together with an issue_id or issue_url, or, from Sentry's older per-project WebHooks plugin, a project_slug next to a nested event ID. Sentry's own Sentry-Hook-Signature header is not checked. A Sentry delivery carries nothing Landfall attaches on, so every delivery opens its own incident.

What you'll need

• An admin on your Landfall organization, to mint the ingest token.
• An Internal Integration in Sentry (Settings → Developer Settings) and at least one issue alert rule. This guide does not create the rule.
• A relay that can receive Sentry's webhook, add the Authorization: Bearer header and forward the body to Landfall.

1. Mint the ingest token

If you already minted one for Datadog, Coralogix or CloudWatch, reuse it: the same token works for every source on this endpoint. Otherwise, mint it with two API calls as a Landfall admin. There is no settings page for it yet.

SESSION=$(curl -s -X POST https://api.landfalls.ai/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"<you>","password":"<your password>","orgSlug":"<your-org>"}' \
  | jq -r .accessToken)

curl -X POST https://api.landfalls.ai/o/<your-org>/triggers/ingest-token \
  -H "Authorization: Bearer $SESSION"

The response is {"token":"<redacted>"}. The token is shown once; Landfall keeps only a hash of it. Minting again replaces it, so every source that uses the old token stops working until you update it.

2. Point Sentry at Landfall

1. Settings → Developer Settings → your Internal Integration

   Set the integration's webhook URL to your relay, and have the relay forward each delivery to https://api.landfalls.ai/triggers with the ingest token. Toggle on Alert Action, so alert rules can send to this integration.

2. Alerts → your issue alert rule → Send a notification via <your integration>

   Add this action to every issue alert rule that should open a war room, and save the rule.

What Sentry's fields become

3. Test it

The quickest check is to post a realistic body yourself, with the header your relay adds. This is close to a real issue alert delivery:

curl -i -X POST https://api.landfalls.ai/triggers \
  -H "Authorization: Bearer <your ingest token>" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "triggered",
    "actor": { "id": "sentry", "name": "Sentry", "type": "application" },
    "data": {
      "event": {
        "event_id": "e4874d664c3540c1a32eab185f12c5ab",
        "project": 1,
        "issue_id": "1117540176",
        "issue_url": "https://sentry.io/api/0/issues/1117540176/",
        "level": "error",
        "title": "ReferenceError: heck is not defined",
        "culprit": "?(<anonymous>)",
        "timestamp": 1566248777.677
      },
      "triggered_rule": "Very Important Alert!"
    },
    "installation": { "uuid": "a8e5d37a-696c-4c54-adb5-b3f28d64c7de" }
  }'

Landfall answers 201 with "outcome": "opened", and the Incidents list shows ReferenceError: heck is not defined at sev2 with a Sentry badge. No service is attached, because this body carries only a numeric project ID.

Repeats and recovery

Sentry deliveries carry no identity Landfall attaches on, so every delivery opens its own incident. Coralogix works the same way; Datadog and CloudWatch attach a repeat to the open incident instead. If a rule fires again and again for one issue, narrow the rule's conditions in Sentry.

Resolving the issue in Sentry records nothing in Landfall, and Landfall never closes an incident because of a Sentry delivery.

Troubleshooting

Reference

Sentry uses the same trigger pipeline as every other source; see Integrations architecture.