Skip to main content
PagerDuty connects to CloudThinker through a webhook: PagerDuty sends each incident event to Resolve, which can open an incident and start a root cause analysis (RCA). The webhook is signed with a secret that PagerDuty generates, so Resolve can prove each event came from your account.
This is a one-way feed: there’s no PagerDuty API connection today. See Agent capabilities for what that rules out.

​
Prerequisites

  • The Admin role in your CloudThinker workspace. Only workspace Admins can create or edit webhooks.
  • Permission in PagerDuty to add a webhook under Integrations → Generic Webhooks (v3).
  • A PagerDuty service you can trigger a test incident on.
  • Connections to the systems behind your services, such as AWS or Datadog, if you want the RCA to query them.

​
Setup

1

Create the webhook in CloudThinker

Go to Resolve → Triggers & Outcomes and select PagerDuty. Under Signals to Resolve, click Add signal. The Create Webhook dialog opens with the PagerDuty preset.On Basic Info, keep or change Webhook Name and click Next. On Configure, change Service Path by hand from the preset event.data.service.name to event.data.service.summary. PagerDuty v3 events carry the service name in summary, and the preset doesn’t set that for you. Leave the rest of Field Mapping and Severity Mapping as they are and click Next.
2

Keep the PagerDuty signature settings

On Advanced, Auth Method is already HMAC Signature with HMAC Signature Header set to X-PagerDuty-Signature. Leave both. Leave Provider signing secret blank for now. Keep Auto-investigate on for your first test, so the test incident gets an RCA, and click Create.Copy the Webhook URL from the dialog that opens. You don’t need the secret it shows, because PagerDuty signs with its own.
3

Add the webhook in PagerDuty

In PagerDuty, go to Integrations → Generic Webhooks (v3) and click New Webhook. Paste the CloudThinker Webhook URL. Set Scope Type to Service (or Account) and pick the Scope whose incidents you want to send. Then select these events:
  • incident.triggered
  • incident.acknowledged
  • incident.resolved
Save the webhook, then copy the signing secret PagerDuty shows. PagerDuty shows it only once, so copy it before you close the dialog.
4

Paste the PagerDuty secret into CloudThinker

Back on Resolve → Triggers & Outcomes → PagerDuty, find your webhook under Signals to Resolve. Open its menu (⋯), click Edit, paste the secret into Provider signing secret, and click Save.Success state: the webhook is listed under Signals to Resolve, and Resolve now verifies every PagerDuty event with your PagerDuty secret.
Until you paste the PagerDuty secret, every PagerDuty event fails the signature check and is rejected. If you regenerate the secret in PagerDuty later, paste the new one the same way.

​
Connection details

The PagerDuty preset maps these fields from PagerDuty’s v3 webhook payload: Severity Mapping translates the values PagerDuty sends into CloudThinker’s five levels. Incident events carry the incident priority (P1 to P5) in priority.summary. The critical, error, warning, and info rows only match if you point Severity Path at a field that holds those values. Matching ignores case, so P1 and p1 both map to critical. An incident with no priority set arrives as medium. Priority names are set per PagerDuty account, so if yours aren’t P1 to P5, add them to Severity Mapping.

​
Required permissions

CloudThinker needs nothing from PagerDuty except the signed events. There’s no API key to store.
Scope the PagerDuty webhook to the services you want investigated, not the whole account. Fewer, relevant events make each RCA faster to read.

​
Agent capabilities

From event to investigation: By event type: See Webhook signals for every Auto-investigate option, including a minimum severity.

​
Verify the connection

Trigger a test incident on a non-production PagerDuty service, then check two places:
  1. Resolve → Pulse shows a signal with the PagerDuty incident title, the right severity, and the service.
  2. Resolve → Investigation shows the incident. With Auto-investigate and On duty both on, it shows AI is handling.
Success state: both appear within a minute or two. Resolve the test incident in PagerDuty when you’re done.

​
Troubleshooting

The signature check failed. Check: that you pasted the PagerDuty signing secret into Provider signing secret, not the CloudThinker secret, and that HMAC Signature Header is X-PagerDuty-Signature. Fix: copy the secret from the PagerDuty webhook again, edit the CloudThinker webhook, paste it, and click Save.
The incident has no priority, or the value isn’t in Severity Mapping. Fix: set priorities in PagerDuty, or edit the webhook and add a mapping row for the value PagerDuty sends.
Service Path still has the preset value event.data.service.name, which PagerDuty v3 events don’t carry, so Resolve records the service as unknown and Pulse can’t group by it. Fix: edit the webhook and set Service Path to event.data.service.summary.
Auto-investigate is off, the severity is below its minimum, or On duty shows Paused. Fix: check all three, or start the investigation by hand. See Resolve settings.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Signed events only. Keep HMAC Signature on so Resolve rejects any event that isn’t signed with your PagerDuty secret.
  • Rotate both sides. When you regenerate the signing secret in PagerDuty, paste the new value into Provider signing secret right away. Events fail until you do.
  • Delete when done. Delete the webhook in PagerDuty and in Resolve → Triggers & Outcomes when you stop using it. Deleting only the CloudThinker side leaves PagerDuty sending events that fail.

Webhook signals

Field mapping, authentication, and Auto-investigate options

Rootly Connection

Triage incidents and action items in Rootly