Documentation

Alerts and channels

A channel is somewhere an alert can go. Add as many as you like, then choose per monitor which are routine and which are for escalation.

What you can add

Add these yourself, from Settings → Notifications:

• Email — any address.
• Slack, Teams, Discord — an incoming webhook URL from that app.
• Telegram — a chat, linked through our bot.
• PagerDuty and Jira Service Management — an integration key.
• Webhook — your own endpoint. HTTPS only, signed, and see below.

These are added by the person who receives them, not typed in by somebody else:

• Push — install the mobile app and allow notifications.
• SMS — enrol your own number and confirm a code we text to it.
• WhatsApp — the same, on WhatsApp.
• Satellite — an Iridium, Inmarsat or Thuraya handset, reached by email through the carrier.

Whose channel is it

Every channel is either the team’s or one person’s, and the difference decides what happens when somebody leaves.

A shared channel — a #alerts webhook, a PagerDuty service, a distribution list — belongs to the organisation and survives any departure.

A personal one — a handset, a private Telegram chat, a mobile number — belongs to the person who enrolled it, and is deleted when they are removed from the organisation. Before that was true, a removed colleague’s Telegram chat kept receiving outage text indefinitely, with their membership and API keys already revoked.

So when you are routing an alert, check whose channel you are routing it to. The person who wires up paging is usually not the person it wakes.

An address has to agree before it is sent anything

Email, SMS, WhatsApp and satellite all confirm first. Add an email channel and the address receives exactly one message — asking whether it wants to be an alert destination — and nothing else until it says yes. Enrol a phone number and you type back a code.

This exists because an email channel is an address somebody else typed into somebody else’s account. Without it, an editor could aim a flapping monitor at a stranger’s inbox and we would deliver it. The test-send button is refused until the address has confirmed, for the same reason: otherwise it is an unlimited way to mail an unconsented address, wearing a helpful label.

Chat and push channels do not ask, and that is not an exception. Whoever pasted a Slack webhook URL had to hold it, and a push channel is registered by the handset’s own owner — neither can be aimed at a stranger by typing an address.

An address that already belongs to a verified member of your organisation is confirmed automatically. They proved it was theirs when they signed up.

SMS and WhatsApp

Both are on Pro and above, and both draw on the same allowance — Pro gets 10 a day, 15 a week and 30 a month; Business and Enterprise get 15, 50 and 100. They are one pool because both cost money per message and both reach the same handset, so the thing the cap protects against — one flapping monitor spending a month’s budget in an hour — is one event however it is carried.

Three windows rather than one, because one is the wrong shape. A monthly cap alone lets a single flapping monitor spend the lot in an afternoon; a daily cap alone lets a slow drip cost thirty times what you intended.

The cap is applied when the message is queued, so a blocked message never occupies a slot, and it is counted from what was actually sent rather than from a counter — a counter cannot be kept honest across a call to somebody else’s API.

SMS does not reach everywhere, and we say so before you enrol

SMS reach depends on the recipient’s country. Some networks will not carry a message from a sender like ours at all; others accept it only from a sender name registered with the local regulator. The country picker only offers destinations we believe we can reach, and the pricing page has the full list.

Where the sender name may be replaced by a local number, you are told at enrolment rather than discovering it from a message that arrives from a stranger.WhatsApp has none of these limits, needs no registration anywhere, and reaches every country SMS cannot.

Alerts never contain links. Carriers filter unknown URLs, and a filtered alert is one you never receive — so a monitor calledacme.com arrives as acme com.

Satellite

For a handset with no cellular network at all. Messages go by email through the carrier’s gateway, so you pay email rates rather than SMS ones — but the carriers cap delivery at five messages a day to each handset, which is their limit rather than ours, and each message is cut to 160 characters.

Unusually slow

A monitor can pass every check and still be in trouble. Once it has at least a day of history, we compare how fast it answers now with how fast it usually answers from the same vantage point, and tell you when it is far slower than normal — through the same channels an incident on that monitor would use. When it is back to its usual speed, we say that too. This is on every plan.

It is not an incident. Nothing is down, so it does not count against uptime, does not appear on a status page and does not escalate. Faster than usual never alerts; a slowdown has to be at least 100 ms and well outside the monitor’s normal variation; and nothing is judged while the monitor is paused, inside a maintenance window, or already has an incident open.

A webhook receives these as latency_anomaly and latency_recovered events, with the usual and observed response times in milliseconds.

Webhooks

HTTPS only. Each request is signed so you can verify it came from us. Private and link-local addresses are refused when you save the URL and again when the alert is sent — because a hostname that resolved to a public address when you saved it can resolve somewhere else later, and a URL that validated can answer with a redirect to anywhere. Redirects are not followed.

On-call

On Pro and above. Build a rotation, set the escalation steps, and an unacknowledged incident moves up them. Acknowledging stops the escalation; resolving closes it.

Escalation is what makes a personal channel worth adding: the first step can be the team chat and the last one somebody’s phone at four in the morning.

Postmortems

On every plan. Once an incident is resolved, anybody who may resolve incidents can write its postmortem — what happened, why, and what changes — and edit it as the investigation goes on. There is one per incident, written in Markdown: headings, bold and italics, lists, code, quotes and links. HTML is shown as text, never run.

A postmortem is internal. It never appears on a status page, because it usually names people, systems and mistakes. Saving one is recorded in the audit log, by length rather than by content.

What happens when nothing can be delivered

A channel that fails records the reason on itself, in the provider’s own words, rather than failing silently. A rejected SMS says what the network said. A WhatsApp message rejected minutes after being accepted says which template and which language.

This matters more than it sounds. Every one of these providers answers “accepted” immediately and reports the real outcome later — so without reading that report, a channel would look verified, the message would look sent, and the first anybody would hear is an outage nobody was told about.