[PagerDuty] List abilities. GET /abilities. Returns raw PagerDuty JSON.

[PagerDuty] List priorities. GET /priorities. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] Test an ability. GET /abilities/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] List audit records. The audit trail of changes made to the account. Without since and until PagerDuty reports the last 24 hours, and until may not be more than 31 days after since, so a longer history has to be swept in windows. GET /audit/records. Optional filters: since, until, root_resource_types[], actor_type, actor_id, method_type, method_truncated_token, actions[]. Paged with an opaque cursor: pass the previous response next_cursor value back as cursor. A null next_cursor means there are no more pages. Returns raw PagerDuty JSON.

[PagerDuty] List License Allocations. One row per user showing which licence that user holds; this is where a seat count is reconciled against the licences pd_list_licenses reports. GET /license_allocations. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] List Licenses. Every licence the account holds comes back in one answer: PagerDuty declares no limit, offset or cursor on this endpoint, so there is nothing to page and no page arguments to send. GET /licenses. Returns raw PagerDuty JSON.

[PagerDuty] List notifications. Reports the notifications PagerDuty actually SENT to responders - SMS, e-mail, phone and push - in a window. since and until are both REQUIRED and the window must be shorter than 3 months, so a longer history has to be swept in windows. Each record carries the responder's address, which is their real phone number or e-mail. GET /notifications. Required filters: since, until. Optional filters: time_zone, filter, include[]. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: revoke one user's OAuth delegations (mobile app, web app or both). Why this is destructive: the named user is signed out of the PagerDuty mobile app, the web app or both at once and has to sign in again everywhere; PagerDuty keeps nothing to restore. Both user_id and type are required, and the vendor's own name for the operation says "all" because it revokes every delegation of those types for that ONE user - it is not an account-wide revocation. DELETE /oauth_delegations. Required filters: user_id, type. Returns raw PagerDuty JSON.

[PagerDuty] Get OAuth delegations revocation requests status. PagerDuty deprecated this read when it made OAuth revocation synchronous, so there is no longer an asynchronous request to poll: the replacement is pd_delete_all_oauth_delegations (DELETE /oauth_delegations), which reports the outcome in its own answer. DEPRECATED: PagerDuty flags this operation deprecated in its own API document; prefer the current equivalent where one exists, and expect it to be withdrawn. GET /oauth_delegations/revocation_requests/status. Optional filters: requested_at_end. Returns raw PagerDuty JSON.

[PagerDuty] Get Paused Incident Reporting counts. Requires PagerDuty's Event Intelligence package or a Digital Operations plan - an account without it is refused rather than answering zero. The reporting period looks back at most 6 months. GET /paused_incident_reports/counts. Optional filters: since, until, service_id, suspended_by. Returns raw PagerDuty JSON.

[PagerDuty] Get a sample of recently paused alerts. Requires PagerDuty's Event Intelligence package or a Digital Operations plan - an account without it is refused rather than answering zero. The reporting period looks back at most 6 months. PagerDuty answers with a fixed sample rather than a page: the 5 most recent alerts that triggered after being paused and the 5 most recent that resolved while paused. GET /paused_incident_reports/alerts. Optional filters: since, until, service_id, suspended_by. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an account's session configurations. Why this is destructive: it drops the account's session-lifetime configuration for the types you name and every user falls back to PagerDuty's own defaults; PagerDuty keeps no copy of the values that were set, and type accepts mobile, web, or both as a comma-separated list. DELETE /session_configurations. Required filters: type. Returns raw PagerDuty JSON.

[PagerDuty] Get an account's session configurations. PagerDuty answers 404 when the account has never set a session configuration - that is 'not configured' rather than a broken call, and the account then runs on PagerDuty's own session defaults. Omitting type returns both the mobile and the web configuration. GET /session_configurations. Optional filters: type. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: configure an account's session configurations. Why this is destructive: it sets the session lifetime for EVERY user on the account, and PagerDuty REVOKES every existing session of the types you name the moment it is saved - so everyone signed into that app is signed out immediately; the previous values are not kept. PUT /session_configurations. Required filters: type. The configuration as JSON: {"session_configuration": {"absolute_session_ttl": 3600, "idle_session_ttl": 600}}. Both are seconds and both are required; PagerDuty accepts 600 to 18144000 for absolute_session_ttl and 60 to 15552000 for idle_session_ttl. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an SRE Agent memory. Why this is destructive: it permanently deletes the memory and PagerDuty keeps no copy; a conversation already running may keep using it, so PagerDuty's own advice is to ask the agent to delete a runbook when it has to be gone from a live conversation. DELETE /sre_agent/memories/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] List SRE Agent memories. The memories PagerDuty's SRE Agent works from - runbooks, service profiles and incident playbooks - so an account without the SRE Agent product has none. PagerDuty declares no offset and no cursor here: limit caps at 100 and there is no way to reach a record past it, so narrow with service_id, incident_id or type instead of paging. GET /sre_agent/memories. Optional filters: service_id, incident_id, type. Returns raw PagerDuty JSON.

[PagerDuty] Update an SRE Agent memory. Not destructive: it replaces the text of ONE memory, nothing is paged or notified and the memory can be rewritten again - but the previous text is not kept, and a conversation already running may keep the old one until it ends. PUT /sre_agent/memories/. Path parameters: id. The new memory as JSON: {"memory": {"content": "..."}}. content is the whole memory text and REPLACES what is stored. Returns raw PagerDuty JSON.

[PagerDuty] List a resource's standards scores. Scores ONE named resource against the account's standards. The sibling pd_list_resources_standards_scores is PagerDuty's many-resource form, but how PagerDuty parses its ids array has not been verified against a live account, so scoring several resources is reliably done by calling THIS tool once per id. GET /standards/scores//. Path parameters: id, resource_type. Returns raw PagerDuty JSON.

[PagerDuty] List resources' standards scores. Scores the resources you name against the account's standards. ids is REQUIRED - PagerDuty scores only the resources you name rather than the whole account - and the endpoint declares no limit, offset or cursor, so the answer is exactly the resources you asked for. PagerDuty documents a maximum of 100 ids for the endpoint; read the ids parameter before asking for more than one. GET /standards/scores/. Path parameters: resource_type. Required filters: ids. Returns raw PagerDuty JSON.

[PagerDuty] List Standards. The account's standards - the rules PagerDuty scores resources against. The endpoint declares no limit, offset or cursor, so every standard comes back at once. Mind the spelling: the resource_type FILTER here is SINGULAR (technical_service) while the same value is plural in the /standards/scores paths (technical_services). GET /standards. Optional filters: active, resource_type. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update a standard. Why this is destructive: PagerDuty REPLACES the stored standard with the definition you send, so an inclusion, an exclusion or a regex you leave out is gone and the standard scores a different set of resources from the next evaluation onward. Send the COMPLETE definition. Standards SCORE existing resources and page nobody, and the change can be made again once you have read the current definition back. PUT /standards/. Path parameters: id. The standard as JSON. PagerDuty documents active (whether the standard is in force), values.regex (the pattern it tests), description, and the inclusions and exclusions lists that pick which resources are scored. Send the COMPLETE definition - PagerDuty replaces the stored standard with what you send. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: add and remove tags on a user, team or escalation policy. Why this is destructive: the remove list DELETES tag assignments from the entity in the same call that adds, PagerDuty keeps no record of what was assigned before, and an add element of type tag CREATES a new account-wide tag when no tag with that label exists. POST ///change_tags. Path parameters: entity_type, id. The tag changes as JSON. add takes {"type": "tag", "label": "Batman"} - which reuses the existing tag with that label or creates one - or {"type": "tag_reference", "id": "PTAG123"}; remove takes {"type": "tag_reference", "id": "PTAG123"}. Both arrays are optional and are applied in the one call. Returns raw PagerDuty JSON.

[PagerDuty] Create a tag. Not destructive: additive: a new tag labels nothing until it is assigned to a user, team or escalation policy, and it changes nothing else on the account. POST /tags. The tag as JSON: {"tag": {"type": "tag", "label": "Batman"}}. Only type and label are writable and a label is capped at 191 characters; the id, summary, self and html_url PagerDuty lists on the tag schema are read-only and are ignored on the way in. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete a tag. Why this is destructive: deleting a tag removes it from every user, team and escalation policy it was assigned to, in one step, and PagerDuty keeps no record of which entities carried it. DELETE /tags/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get a tag. Returns the tag itself - its label - and not the users, teams or escalation policies it is assigned to; pd_list_tag_entities answers that. GET /tags/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] List the tags on one user, team or escalation policy. The mirror image is pd_list_tag_entities, which starts from a tag and lists the entities carrying it - the two take the same two values in the opposite order. GET ///tags. Path parameters: entity_type, id. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] List the users, teams or escalation policies carrying a tag. The mirror image is pd_list_entity_tags, which starts from one entity and lists its tags - the two take the same two values in the opposite order. GET /tags//. Path parameters: id, entity_type. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] List tags. Every tag on the account, each with the label it applies. A tag here is only the label: what it is assigned to comes from pd_list_tag_entities. GET /tags. Optional filters: query. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] Create a template. Not destructive: additive: a new template renders nothing until a status update or notification names it. POST /templates. The template as JSON: {"template": {"template_type": "status_update", "name": "...", "description": "...", "templated_fields": {"email_subject": "...", "email_body": "...", "message": "..."}}}. status_update is the only template_type PagerDuty supports today; email_body is HTML and message is the short form used for SMS, push and chat. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete a template. Why this is destructive: it deletes the template and PagerDuty keeps no copy; status updates already sent are unaffected, but anything that rendered from this template has to be pointed at another one. DELETE /templates/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get a template. Returns one template with its templated_fields: the e-mail subject, the HTML e-mail body and the short message PagerDuty renders for SMS, push and chat. pd_render_template renders it against a real incident without changing or sending anything. GET /templates/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] List template fields. The fields an account's templates may reference - read this before writing a template body so templated_fields names something PagerDuty will actually substitute. The endpoint declares no limit, offset or cursor, so the whole list comes back at once. GET /templates/fields. Returns raw PagerDuty JSON.

[PagerDuty] List templates. Templates are the bodies PagerDuty renders when a status update is sent on an incident. status_update is the only type PagerDuty supports today and template_type defaults to it. GET /templates. Optional filters: query, template_type, sort_by. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] Render a template. This is a POST-shaped READ: it renders the template against the object you name and stores nothing. PagerDuty's own scope line for it is templates.read. POST /templates//render. Path parameters: id. The render input as JSON. PagerDuty varies the shape by template type; for status_update it documents {"incident_id": "PABC123", "status_update": {"message": "text passed to the template"}} plus an optional external object the template may reference. Nothing is stored and no status update is sent. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update a template. Why this is destructive: PagerDuty replaces the stored template with what you send, so a templated field you leave out is gone and every future status update renders without it. Send the COMPLETE templated_fields set. Updates already sent are unaffected and the template can be rewritten again. PUT /templates/. Path parameters: id. The template as JSON: {"template": {"template_type": "status_update", "name": "...", "description": "...", "templated_fields": {"email_subject": "...", "email_body": "...", "message": "..."}}}. Send the COMPLETE templated_fields set - PagerDuty replaces the stored template with what you send. Returns raw PagerDuty JSON.

[PagerDuty] Get a vendor. Vendors are PagerDuty's own global integration catalogue - Datadog, AWS CloudWatch and the rest - shared by every account, so this id is the vendor a service integration is created FROM and not anything the account owns. GET /vendors/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] List vendors. PagerDuty's global catalogue of integration vendors, identical for every account: this is where the vendor id for a new service integration comes from. GET /vendors. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] Get aggregated PD Advance usage data. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. PD Advance is a separately-licensed PagerDuty product; an account without it answers 402 or 403. POST /analytics/metrics/pd_advance_usage/features. Send the request body as JSON; PagerDuty documents these fields: filters.created_at_start, filters.created_at_end, filters.incident_created_at_start, filters.incident_created_at_end, filters.urgency, filters.major, filters.min_ackowledgements, filters.min_timeout_escalations, filters.min_manual_escalations, filters.team_ids, filters.service_ids, filters.escalation_policy_ids, filters.priority_ids, filters.priority_names, time_zone. Returns raw PagerDuty JSON.

[PagerDuty] Get aggregated metrics for all escalation policies. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/metrics/incidents/escalation_policies/all. Send the request body as JSON; PagerDuty documents these fields: filters.created_at_start, filters.created_at_end, filters.urgency, filters.major, filters.min_ackowledgements, filters.min_timeout_escalations, filters.min_manual_escalations, filters.team_ids, filters.service_ids, filters.escalation_policy_ids, filters.priority_ids, filters.priority_names, filters.pd_advance_used, time_zone, order, order_by, aggregate_unit. Returns raw PagerDuty JSON.

[PagerDuty] Get aggregated metrics for all responders. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/metrics/responders/all. Send the request body as JSON; PagerDuty documents these fields: filters.date_range_start, filters.date_range_end, filters.urgency, filters.team_ids, filters.responder_ids, filters.priority_ids, filters.priority_names, time_zone, order, order_by. Returns raw PagerDuty JSON.

[PagerDuty] Get aggregated metrics for all services. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/metrics/incidents/services/all. Send the request body as JSON; PagerDuty documents these fields: filters.created_at_start, filters.created_at_end, filters.urgency, filters.major, filters.min_ackowledgements, filters.min_timeout_escalations, filters.min_manual_escalations, filters.team_ids, filters.service_ids, filters.escalation_policy_ids, filters.priority_ids, filters.priority_names, filters.pd_advance_used, time_zone, order, order_by, aggregate_unit. Returns raw PagerDuty JSON.

[PagerDuty] Get aggregated metrics for all teams. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/metrics/incidents/teams/all. Send the request body as JSON; PagerDuty documents these fields: filters.created_at_start, filters.created_at_end, filters.urgency, filters.major, filters.min_ackowledgements, filters.min_timeout_escalations, filters.min_manual_escalations, filters.team_ids, filters.service_ids, filters.escalation_policy_ids, filters.priority_ids, filters.priority_names, filters.pd_advance_used, time_zone, order, order_by, aggregate_unit. Returns raw PagerDuty JSON.

[PagerDuty] Get aggregated metrics for all users. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/metrics/users/all. Send the request body as JSON; PagerDuty documents these fields: filters.created_at_start, filters.created_at_end, filters.team_ids, filters.user_ids, filters.role_ids, time_zone, order, order_by, aggregate_unit, limit, starting_after, ending_before. Returns raw PagerDuty JSON.

[PagerDuty] Get aggregated escalation policy data. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/metrics/incidents/escalation_policies. Send the request body as JSON; PagerDuty documents these fields: filters.created_at_start, filters.created_at_end, filters.urgency, filters.major, filters.min_ackowledgements, filters.min_timeout_escalations, filters.min_manual_escalations, filters.team_ids, filters.service_ids, filters.escalation_policy_ids, filters.priority_ids, filters.priority_names, filters.pd_advance_used, time_zone, order, order_by, aggregate_unit. Returns raw PagerDuty JSON.

[PagerDuty] Get aggregated incident data. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/metrics/incidents/all. Send the request body as JSON; PagerDuty documents these fields: filters.created_at_start, filters.created_at_end, filters.urgency, filters.major, filters.min_ackowledgements, filters.min_timeout_escalations, filters.min_manual_escalations, filters.team_ids, filters.service_ids, filters.escalation_policy_ids, filters.priority_ids, filters.priority_names, filters.pd_advance_used, time_zone, order, order_by, aggregate_unit. Returns raw PagerDuty JSON.

[PagerDuty] Get raw data - single incident. one incident's analytics record. PagerDuty's analytics data lags live incident data by up to 24 hours, so a very recent incident may not be there yet - pd_get_incident is the live read. GET /analytics/raw/incidents/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get responder data aggregated by team. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/metrics/responders/teams. Send the request body as JSON; PagerDuty documents these fields: filters.date_range_start, filters.date_range_end, filters.urgency, filters.team_ids, filters.responder_ids, filters.priority_ids, filters.priority_names, time_zone, order, order_by. Returns raw PagerDuty JSON.

[PagerDuty] Get aggregated service data. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/metrics/incidents/services. Send the request body as JSON; PagerDuty documents these fields: filters.created_at_start, filters.created_at_end, filters.urgency, filters.major, filters.min_ackowledgements, filters.min_timeout_escalations, filters.min_manual_escalations, filters.team_ids, filters.service_ids, filters.escalation_policy_ids, filters.priority_ids, filters.priority_names, filters.pd_advance_used, time_zone, order, order_by, aggregate_unit. Returns raw PagerDuty JSON.

[PagerDuty] Get aggregated team data. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/metrics/incidents/teams. Send the request body as JSON; PagerDuty documents these fields: filters.created_at_start, filters.created_at_end, filters.urgency, filters.major, filters.min_ackowledgements, filters.min_timeout_escalations, filters.min_manual_escalations, filters.team_ids, filters.service_ids, filters.escalation_policy_ids, filters.priority_ids, filters.priority_names, filters.pd_advance_used, time_zone, order, order_by, aggregate_unit. Returns raw PagerDuty JSON.

[PagerDuty] Get raw data - multiple incidents. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/raw/incidents. Send the request body as JSON; PagerDuty documents these fields: filters.created_at_start, filters.created_at_end, filters.updated_after, filters.urgency, filters.major, filters.team_ids, filters.service_ids, filters.priority_ids, filters.priority_names, filters.incident_type_ids, starting_after, ending_before, order, order_by, limit, time_zone. Returns raw PagerDuty JSON.

[PagerDuty] Get raw responses from a single incident. the optional request BODY carries this call's limit, order, order_by and time_zone - the endpoint declares no query parameters. PagerDuty's analytics data lags live incident data by up to 24 hours. GET /analytics/raw/incidents//responses. Path parameters: id. Send the request body as JSON; PagerDuty documents these fields: limit, order, order_by, time_zone. Returns raw PagerDuty JSON.

[PagerDuty] Get raw incidents for a single responder_id. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/raw/responders//incidents. Path parameters: responder_id. Send the request body as JSON; PagerDuty documents these fields: filters.created_at_start, filters.created_at_end, filters.urgency, filters.major, filters.team_ids, filters.service_ids, filters.priority_ids, filters.priority_names, filters.incident_type_ids, starting_after, ending_before, order, order_by, limit, time_zone. Returns raw PagerDuty JSON.

[PagerDuty] Get raw user analytics data. This is a POST-shaped READ: the filters AND the paging (starting_after, ending_before, limit) travel in the request body, and the endpoint declares no query parameters at all. PagerDuty's analytics data lags live incident data by up to 24 hours, and a query with no date filter sweeps the whole retention window - always send filters.created_at_start and filters.created_at_end. POST /analytics/raw/users. Send the request body as JSON; PagerDuty documents these fields: filters.created_at_start, filters.created_at_end, filters.team_ids, filters.user_ids, filters.role_ids, time_zone, order, order_by, aggregate_unit, limit, starting_after, ending_before. Returns raw PagerDuty JSON.

[PagerDuty] Associate a runner with a team. Not destructive: it binds one team to this runner so that team's people can use it. The body carries a single team reference rather than a replacement list, so nothing already bound is disturbed, and pd_remove_automation_action_runner_team unbinds it again. Nothing executes as a result. POST /automation_actions/runners//teams. Path parameters: id. Required field: team.type. Send team as an object with id set to the team id and type set to team_reference. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: associate an Automation Action with a service. Why this is destructive: it arms remote execution on that service. The bound action runs a script or a Process Automation job on a runner the customer hosts themselves, and once it is bound it becomes invocable on that service's incidents - by a person in PagerDuty, and WITHOUT one by an Event Orchestration, because the action's allow_invocation_from_event_orchestration switch defaults to true. That switch and allow_invocation_manually belong to the ACTION and are not set here, so read the action with pd_get_automation_action before you bind it. The bind itself is additive - the body carries a single service reference rather than a replacement list, so nothing already bound is disturbed - and pd_remove_automation_action_service unbinds it again. POST /automation_actions/actions//services. Path parameters: id. Required field: service.type. Send service as an object with id set to the service id and type set to service_reference. Returns raw PagerDuty JSON.

[PagerDuty] Associate an Automation Action with a team. Not destructive: it binds one team to this action so that team's people can see it and invoke it manually. The body carries a single team reference rather than a replacement list, so nothing already bound is disturbed, and pd_remove_automation_action_team unbinds it again. It confers no capability of its own: what the action runs, and whether it may be invoked by hand or by an Event Orchestration at all, are the action's own allow_invocation_manually and allow_invocation_from_event_orchestration switches, which pd_get_automation_action reads. Scope it deliberately all the same - the people in that team can then run it. POST /automation_actions/actions//teams. Path parameters: id. Required field: team.type. Send team as an object with id set to the team id and type set to team_reference. Returns raw PagerDuty JSON.

[PagerDuty] Create an Automation Action. Not destructive: a new action runs nothing until something invokes it, and pd_delete_automation_action removes it again. Two defaults deserve a deliberate choice: allow_invocation_from_event_orchestration and allow_invocation_manually both default to true, so the action is runnable the moment it is bound to a service, and map_to_all_services set to true binds it to EVERY service on the account in one step. POST /automation_actions/actions. Required field: action. action.action_type is the discriminator and PagerDuty documents two values: script and process_automation. name, description and action_type are required on both. A script action carries action_data_reference.script - the script body the runner writes to a temp file and executes - plus an optional invocation_command naming the interpreter. A process_automation action carries action_data_reference.process_automation_job_id plus optional process_automation_job_arguments and process_automation_node_filter. runner names the runner id it executes on; services and teams bind it at creation; map_to_all_services binds it to every service. action_classification tags the action diagnostic or remediation, and only_invocable_on_unresolved_incidents, default false, confines it to unresolved incidents. PagerDuty caps an account at 10,000 actions and answers 400 beyond that. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: create an Invocation. Why this is destructive: it EXECUTES the action on the customer's own runner immediately - a script or a Process Automation job runs on their infrastructure, and neither PagerDuty nor StackJack can recall it once it is sent. There is no dry run and no preview: the only way to know what it will do is to read the action first with pd_get_automation_action. POST /automation_actions/actions//invocations. Path parameters: id. Required field: invocation.metadata. PagerDuty attaches every invocation to an incident, so metadata.incident_id is required; metadata.alert_id is optional. No arguments travel in this body - what runs is whatever the action's stored definition says. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: create an Automation Action runner. Why this is destructive: it MINTS a credential: the 201 response carries runner.secret, which PagerDuty documents as the secret a sidecar runner authenticates with, and PagerDuty does not show it again. A runbook runner instead STORES the customer's Runbook Automation API key, sent in this request body. Neither is a reversible edit, and PagerDuty caps an account at 1,000 runners. POST /automation_actions/runners. Required field: runner. runner.runner_type is the discriminator and PagerDuty documents two values: sidecar and runbook. Both require name and description. A runbook runner ALSO requires runbook_base_uri - the subdomain portion of the Runbook Automation host, alphanumerics, periods, underscores and dashes only - and runbook_api_key, the API key PagerDuty stores to reach that server. A sidecar runner takes neither and is handed a secret in the response instead. teams may bind the runner at creation. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an Automation Action. Why this is destructive: the action and its definition are gone and PagerDuty keeps no copy, so a script body that lives nowhere else is lost - read it with pd_get_automation_action first. It is also removed from every service and team it was bound to. Past invocations keep their own snapshot of the action, so the run history survives. DELETE /automation_actions/actions/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an Automation Action runner. Why this is destructive: every action that executes through this runner stops working, and the sidecar or Runbook server on the customer's own infrastructure can no longer connect. The runner secret dies with it: a replacement runner is issued a NEW secret, so whoever owns that machine has to reconfigure it. DELETE /automation_actions/runners/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get an Automation Action. Returns one Automation Action's full definition, including the action_data_reference that holds the script body or the Process Automation job id, and the allow_invocation_manually and allow_invocation_from_event_orchestration switches that decide who may run it. Reading it runs nothing. GET /automation_actions/actions/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get an Invocation. Returns one run: its state, the timing transitions it went through, a snapshot of the action as it was when it ran, and the agent - a user, an Event Orchestration or an incident workflow - that started it. GET /automation_actions/invocations/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get an Automation Action runner. Returns one runner's registration: its type (sidecar or runbook), its status (Configured once it has connected to PagerDuty at least once, otherwise NotConfigured), its teams and up to three associated actions. The runner secret is NOT here - PagerDuty returns that only on the creation response. GET /automation_actions/runners/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get the details of a runner / team relation. Answers whether one specific runner / team binding exists, and 404s when it does not. Mind the base: this is the RUNNER side, runners//teams/, while pd_get_automation_action_team is the action side. GET /automation_actions/runners//teams/. Path parameters: id, team_id. Returns raw PagerDuty JSON.

[PagerDuty] Get the details of an Automation Action / service relation. Answers whether one specific Automation Action / service binding exists, and 404s when it does not. GET /automation_actions/actions//services/. Path parameters: id, service_id. Returns raw PagerDuty JSON.

[PagerDuty] Get the details of an Automation Action / team relation. Answers whether one specific Automation Action / team binding exists, and 404s when it does not. Mind the base: this is the ACTION side, actions//teams/, while pd_get_automation_action_runner_team is the runner side. GET /automation_actions/actions//teams/. Path parameters: id, team_id. Returns raw PagerDuty JSON.

[PagerDuty] List Invocations. An invocation is one past or in-flight RUN of an action on a runner. PagerDuty declares no paging on this endpoint - no limit, no offset and no cursor - so the whole matching collection comes back in one response; narrow it with the filters below. GET /automation_actions/invocations. Optional filters: invocation_state, not_invocation_state, incident_id, action_id. Returns raw PagerDuty JSON.

[PagerDuty] Get all team references associated with a runner. Lists the teams that can use this runner. PagerDuty declares no paging on this endpoint, so the whole collection comes back in one response. GET /automation_actions/runners//teams. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] List Automation Action runners. A runner is the customer's own machine or Runbook Automation instance that Automation Actions execute on. This read never returns the runner secret: PagerDuty puts that on the creation response only. GET /automation_actions/runners. Optional filters: name, include[]. Paged with an opaque cursor: pass the previous response next_cursor value back as cursor. A null next_cursor means there are no more pages. Returns raw PagerDuty JSON.

[PagerDuty] Get all service references associated with an Automation Action. Lists the services this Automation Action is offered on. PagerDuty declares no paging on this endpoint, so the whole collection comes back in one response. GET /automation_actions/actions//services. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get all team references associated with an Automation Action. Lists the teams that can see and invoke this Automation Action. PagerDuty declares no paging on this endpoint, so the whole collection comes back in one response. GET /automation_actions/actions//teams. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] List Automation Actions. An Automation Action is a saved script or Process Automation job that runs on a runner the customer hosts themselves. This read returns definitions only and executes nothing: use pd_get_automation_action for one action's full record, and pd_create_automation_action_invocation to actually run one. GET /automation_actions/actions. Optional filters: name, runner_id, classification, team_id, service_id, action_type. Paged with an opaque cursor: pass the previous response next_cursor value back as cursor. A null next_cursor means there are no more pages. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: disassociate a runner from a team. Why this is destructive: the team loses access to this runner and to whatever it was running through it; pd_add_automation_action_runner_team binds it again. DELETE /automation_actions/runners//teams/. Path parameters: id, team_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: disassociate an Automation Action from a service. Why this is destructive: the action stops being offered on that service, so nobody can invoke it there and an Event Orchestration that reaches for it on that service can no longer run it; pd_add_automation_action_service binds it again. DELETE /automation_actions/actions//services/. Path parameters: id, service_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: disassociate an Automation Action from a team. Why this is destructive: the team loses sight of the action and can no longer invoke it; pd_add_automation_action_team binds it again. DELETE /automation_actions/actions//teams/. Path parameters: id, team_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update an Automation Action. Why this is destructive: an Automation Action carries the script body or the Process Automation job that RUNS on the customer's own runner, so replacing its definition changes what executes the next time anyone invokes it. This is a PUT: send the COMPLETE action object, because what you send becomes the stored definition. Read the current one with pd_get_automation_action first. PUT /automation_actions/actions/. Path parameters: id. Required field: action. action.action_type is the discriminator - script or process_automation - and it has to match the action being updated. A script action carries action_data_reference.script and an optional invocation_command; a process_automation action carries action_data_reference.process_automation_job_id with optional process_automation_job_arguments and process_automation_node_filter. The invocation switches allow_invocation_manually, allow_invocation_from_event_orchestration, only_invocable_on_unresolved_incidents and map_to_all_services are set here too, along with action_classification - diagnostic or remediation - and runner, which moves the action onto a different runner. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update an Automation Action runner. Why this is destructive: it STORES a credential and can move where work runs. runbook_api_key is the API key PagerDuty keeps to reach the customer's Runbook Automation server, and what you send overwrites the stored one - PagerDuty keeps the previous key only when the field is omitted entirely. runbook_base_uri re-points every action on this runner at a different Runbook host. This is a PUT: send the COMPLETE runner object. PUT /automation_actions/runners/. Path parameters: id. Required field: runner. PagerDuty declares runner_type as this body's discriminator. The sidecar shape accepts name and description. The runbook shape also accepts runbook_base_uri - the subdomain portion of the Runbook Automation host - and runbook_api_key, and PagerDuty documents that an omitted runbook_api_key leaves the stored key unchanged. Returns raw PagerDuty JSON.

[PagerDuty] Add a CMDB table. Not destructive: the table is registered with status disabled and pulls nothing until its synchronization is enabled by a separate tool; an integration holds at most 8 tables. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. POST /enrichment/integrations/servicenow//tables. Path parameters: integration_id. Send the request body as JSON with cmdb_table: display_name (the name the Event Enrichment rule editor shows), ci_table_name (the ServiceNow CMDB table, case-sensitive, for example cmdb_ci_server), optional query_filter (a ServiceNow encoded query; null synchronizes every record) and field_mappings - 2 to 20 objects of servicenow_field and event_field, of which at most 3 may set type to query and at least one must be left as an enrichment field. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: create ServiceNow credentials. Why this is destructive: the request body carries the ServiceNow account password in clear text and PagerDuty STORES it as the credential every CMDB table sync and table test authenticates with. An account holds ONE credential set, so a second create is refused while one exists, and PagerDuty declares the ServiceNow password write-only: it is accepted in a request and never returned in a response, so no read recovers it - a lost password can only be replaced, never read back. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. POST /enrichment/integrations/servicenow/credentials. Send the request body as JSON with credentials: instance_endpoint (the ServiceNow instance URL), user (a ServiceNow account with read access to the CMDB tables) and password. All three are required. The response echoes the record WITHOUT the password. Returns raw PagerDuty JSON.

[PagerDuty] Create a ServiceNow integration. Not destructive: a new integration synchronizes nothing until a CMDB table is added to it and that table's sync is enabled; PagerDuty allows ONE integration per account, so a second create is refused while one exists. The 201 answers with the whole integration object, which embeds the account's stored ServiceNow credential record - the instance URL and the service-account username, never the password. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. POST /enrichment/integrations/servicenow. Send the request body as JSON with name, optional description and cmdb_tables - 1 to 8 table configurations, each with display_name, ci_table_name, optional query_filter and 2 to 20 field_mappings of servicenow_field and event_field. Credentials are NOT part of this body: they are stored once per account by the credentials tools. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete ServiceNow credentials. Why this is destructive: the stored ServiceNow credential is destroyed and every table synchronization and table test that authenticated with it stops. PagerDuty refuses the call while a ServiceNow integration still exists, so the integration has to go first, and the password cannot be read back before deleting - it is write-only, so it has to be re-entered from the customer's own record. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. DELETE /enrichment/integrations/servicenow/credentials/. Path parameters: credentials_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete a ServiceNow integration. Why this is destructive: it destroys the integration with every CMDB table configuration under it AND the enrichment schemas those tables generated, and disables their synchronization; every enrichment rule reading one of those schemas stops enriching from the next event onward. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. DELETE /enrichment/integrations/servicenow/. Path parameters: integration_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: remove a CMDB table. Why this is destructive: the table's generated enrichment schema is removed and its synchronization is disabled, so every enrichment rule reading that schema stops enriching from the next event onward. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. DELETE /enrichment/integrations/servicenow//tables/. Path parameters: integration_id, table_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: enable CMDB table sync. Why this is destructive: it starts a LIVE synchronization that pulls Configuration Items out of the customer's own ServiceNow instance into PagerDuty and keeps pulling them on a schedule. This API declares no disable endpoint, so the only way to stop it again is to remove the table or the whole integration, and the table can no longer be edited once its first backfill has started. The call itself is idempotent - enabling an already-enabled table succeeds. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. POST /enrichment/integrations/servicenow//tables//enable. Path parameters: integration_id, table_id. Returns raw PagerDuty JSON.

[PagerDuty] Get ServiceNow credentials. Returns the stored ServiceNow credential record - id, instance_endpoint, user and the timestamps. PagerDuty declares the ServiceNow password write-only: it is accepted in a request and never returned in a response, so no read recovers it, and an account holds at most one credential set. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. GET /enrichment/integrations/servicenow/credentials/. Path parameters: credentials_id. Returns raw PagerDuty JSON.

[PagerDuty] Get a ServiceNow integration. Returns the integration with its CMDB tables, their field mappings, the current sync status of each table (disabled, syncing, active or error) and the account's credential record - never the password, which PagerDuty declares write-only. An account holds at most one ServiceNow integration. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. GET /enrichment/integrations/servicenow/. Path parameters: integration_id. Returns raw PagerDuty JSON.

[PagerDuty] List ServiceNow integrations. PagerDuty allows ONE ServiceNow integration per account, so this returns at most one, with its CMDB tables, field mappings and credential record. There are no paging parameters on this endpoint. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. GET /enrichment/integrations/servicenow. Returns raw PagerDuty JSON.

[PagerDuty] Test a CMDB table. This read runs a LIVE query against the customer's own ServiceNow instance with the stored credentials and returns up to 10 sample records. They come back keyed by ServiceNow field name, NOT by the mapped event_field names. Use it to check the table name, the query filter and the mappings before enabling synchronization - a misconfigured table answers 400 here instead of failing after it is live. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. GET /enrichment/integrations/servicenow//tables//test. Path parameters: integration_id, table_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update ServiceNow credentials. Why this is destructive: sending password OVERWRITES the stored ServiceNow password, which PagerDuty keeps no copy of and never returns, so every table synchronization and test authenticates with the new one from that moment and a wrong value puts the tables into status error. The update is partial: only the fields present in the body are changed. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. PUT /enrichment/integrations/servicenow/credentials/. Path parameters: credentials_id. Send the request body as JSON with credentials and only the fields to change: instance_endpoint, user and/or password. The response echoes the record WITHOUT the password. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update a CMDB table. Why this is destructive: it is a FULL replacement of the table configuration - ci_table_name and the COMPLETE field_mappings list must be sent, and any mapping left out is dropped, which silently stops the event fields it was enriching. PagerDuty only accepts it while the table's synchronization is disabled and before its first backfill has started, and refuses it afterwards. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. PUT /enrichment/integrations/servicenow//tables/. Path parameters: integration_id, table_id. Send the request body as JSON with cmdb_table: display_name (the name the Event Enrichment rule editor shows), ci_table_name (the ServiceNow CMDB table, case-sensitive, for example cmdb_ci_server), optional query_filter (a ServiceNow encoded query; null synchronizes every record) and field_mappings - 2 to 20 objects of servicenow_field and event_field, of which at most 3 may set type to query and at least one must be left as an enrichment field. Returns raw PagerDuty JSON.

[PagerDuty] Create an enrichment schema. Not destructive: a new schema holds no records and enriches nothing until records are uploaded into it and an enrichment rule reads it; an account may hold at most 25 CSV schemas. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. POST /enrichment/schemas. Optional filters: filename. Send the request body as JSON with name (up to 50 characters), optional description (up to 2048) and fields - 2 to 25 objects of name and type, where type is query or enriched. 1 to 3 fields must be query and at least one must be enriched, and field names are unique case-insensitively. integration_type accepts only CSV and the schema is recorded as CSV whatever is sent. PagerDuty also accepts a CSV file on this route to derive a schema from its columns; this tool sends the JSON definition. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an enrichment record. Why this is destructive: the record is removed from a live schema, so any enrichment rule that was matching it stops finding it from the next event onward; PagerDuty answers with the deleted record and keeps no other copy. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. DELETE /enrichment/schemas//records/. Path parameters: schema_id, record_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an enrichment schema. Why this is destructive: it soft-deletes the schema, so every record uploaded into it stops being queryable and every enrichment rule pointing at it stops enriching; PagerDuty answers with the deleted schema. Only a CSV schema can be deleted - a SERVICENOW schema belongs to the CMDB integration and is refused here. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. DELETE /enrichment/schemas/. Path parameters: schema_id. Returns raw PagerDuty JSON.

[PagerDuty] Get an enrichment schema. Returns the schema definition: its name, its integration_type (CSV for a schema created through this API, SERVICENOW for one the CMDB integration generates) and its query and enriched fields. The records held in it are a separate read. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. GET /enrichment/schemas/. Path parameters: schema_id. Returns raw PagerDuty JSON.

[PagerDuty] List enrichment records. Returns the records uploaded into one schema, each as enrichment_data keyed by field name. A populated schema holds far more rows than one page: follow next_cursor until it comes back null. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. GET /enrichment/schemas//records. Path parameters: schema_id. Paged with an opaque cursor: pass the previous response next_cursor value back as cursor. A null next_cursor means there are no more pages. Returns raw PagerDuty JSON.

[PagerDuty] List enrichment schemas. PagerDuty declares no paging parameters on this endpoint, so every schema in the account comes back in one response - the CSV schemas created through this API (at most 25) and the schemas the ServiceNow CMDB integration generates. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. GET /enrichment/schemas. Returns raw PagerDuty JSON.

[PagerDuty] Query enrichment data. This is a POST-shaped READ: the schema id and the field values to match travel in the request body and nothing is written. Send 1 to 3 query field/value pairs; ALL of them must match, and matching is case-insensitive. A standard schema answers with 0 or 1 record; a schema that uses a discriminator field can answer with several. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. POST /enrichment/query. Send the request body as JSON with schema_id (the enrichment schema UUID) and query, an array of 1 to 3 objects of field and value - for example schema_id 9f194d8d-0f58-4c5c-b1d2-a5adf7171821 with query [{field: Application, value: Authorization}]. Returns raw PagerDuty JSON.

[PagerDuty] Update an enrichment schema. Not destructive: this route only changes the schema's name and/or description - at least one of the two must be sent - and a schema's fields cannot be changed after it is created, so no record and no enrichment rule can break as a result. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. PUT /enrichment/schemas/. Path parameters: schema_id. Send the request body as JSON with schema: name (up to 50 characters) and/or description (up to 2048). At least one of the two is required and no other field is accepted. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: upload CSV records. Why this is destructive: it bulk-loads rows into a live schema that event enrichment reads, and the load is an UPSERT - a row whose query-field values match an existing record OVERWRITES that record - with no undo. PagerDuty accepts the file ASYNCHRONOUSLY and answers 202 with an upload_id, so the rows are not in the schema yet when the call returns and a malformed file fails later, out of band. PagerDuty declares two request shapes for this route - multipart/form-data with a required file part, or a raw text/csv body - each capped at 10 MB, and StackJack sends the bytes as text/csv; the CSV columns must line up with the schema's fields, a missing column writes empty values and an extra column is ignored. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. POST /enrichment/schemas//records. Path parameters: schema_id. Optional filters: filename. The file arrives EITHER as base64 in contentBase64 OR as a public https URL in sourceUrl - exactly one of the two, never both. StackJack fetches an https URL server-side and refuses a non-https URL, a redirect to a different host, or anything over the size cap named on those parameters. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: add Event Enrichment associations. Why this is destructive: it attaches a LIVE Event Enrichment to the named Services and Event Orchestrations, so their incoming events are enriched differently from the next event onward, and it is a batch that can partially succeed - PagerDuty answers 207 when some targets were attached and others were not, which leaves the enrichment applied to only part of what was asked for. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. POST /enrichment/event_enrichments//associations. Path parameters: id. Send the request body as JSON with associations, an array of objects of type (service_reference or event_orchestration_reference) and id - the Service id or the Event Orchestration id. PagerDuty answers 207 when only some of them were applied, so read the per-association status in the body rather than the HTTP code alone. Returns raw PagerDuty JSON.

[PagerDuty] Create an Event Enrichment. Not destructive: a new Event Enrichment is inert: it enriches nothing until it is associated with a Service or an Event Orchestration, or made the account default, and its rules are written by a separate tool. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. POST /enrichment/event_enrichments. Send the request body as JSON with event_enrichment: name, optional description and optional team.id - those are the only writable fields. Everything else PagerDuty returns on the object (id, is_default, the association counts, privileges, the timestamps and self) is read-only and ignored on the way in. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an Event Enrichment. Why this is destructive: the enrichment stops running, so the fields it was adding stop appearing on live events for every Service and Event Orchestration it was associated with, and PagerDuty keeps no copy. It also requires Delete privileges on the enrichment AND on every item associated with it, so a caller holding only some of them gets a 403 rather than a partial delete. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. DELETE /enrichment/event_enrichments/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete Event Enrichment associations. Why this is destructive: the named Services and Event Orchestrations stop being enriched from the next event onward - they fall back to the account default if one is set, and to no enrichment at all if none is - and it is a batch that can partially succeed, so a 207 means only some of them were detached. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. DELETE /enrichment/event_enrichments//associations. Path parameters: id. Send the request body as JSON with associations, an array of objects of type (service_reference or event_orchestration_reference) and id - the Service id or the Event Orchestration id. PagerDuty answers 207 when only some of them were applied, so read the per-association status in the body rather than the HTTP code alone. Returns raw PagerDuty JSON.

[PagerDuty] Get the account default Event Enrichment. The account default Event Enrichment is the one applied to every Service and Event Orchestration that is not associated with a more specific enrichment. The response carries default (null when the account has no default) and previous_default, which is only present after a change. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. GET /enrichment/event_enrichments/default. Returns raw PagerDuty JSON.

[PagerDuty] Get an Event Enrichment. Returns one Event Enrichment: its name, description, owning team, whether it is the account default, and how many Services and Event Orchestrations are associated with it. Its rules and the list of associated items are separate reads. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. GET /enrichment/event_enrichments/. Path parameters: id. Optional filters: include[]. Returns raw PagerDuty JSON.

[PagerDuty] List Event Enrichment associations. Lists the Services and Event Orchestrations one Event Enrichment is attached to. This endpoint's own spec declares no maximum for limit and StackJack clamps it to 100 - PagerDuty's documented general ceiling for offset-paged reads - and an associated item the API key cannot view is silently left out of the results rather than reported. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. GET /enrichment/event_enrichments//associations. Path parameters: id. Optional filters: association_type. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] Get Event Enrichment rules. Despite the name this returns ONE object, not a page: the enrichment's orchestration_path, whose sets carry the rules, each with its conditions and either extractions or enrichments actions. There are no paging parameters. Read this before pd_update_event_enrichment_rules, which replaces the whole set. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. GET /enrichment/event_enrichments//rules. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] List Event Enrichments. Lists every Event Enrichment in the account with its name, owning team and association counts. This endpoint's own spec declares no maximum for limit and StackJack clamps it to 100 - PagerDuty's documented general ceiling for offset-paged reads. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. GET /enrichment/event_enrichments. Optional filters: include[]. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: mark an Event Enrichment as the account default. Why this is destructive: it changes the ACCOUNT DEFAULT, so every Service and Event Orchestration that is not associated with a more specific enrichment is enriched by the new one from the next event onward; sending default as null CLEARS the default instead, which stops default enrichment account-wide with no other signal. The response returns the enrichment that was replaced as previous_default - keep it if you may need to put it back. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. PUT /enrichment/event_enrichments/default. Send the request body as JSON with default: an object of id (the Event Enrichment id) and type set to event_enrichment_reference - or the literal null to clear the account default. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update an Event Enrichment. Why this is destructive: the PUT REPLACES the stored enrichment with the object you send, and team is the ACCESS CONTROL on it: leave team out and PagerDuty removes the team that owns this enrichment. name and description go the same way, and PagerDuty keeps no prior version. Only those three are writable, so there is no way to say "leave team alone" - read the object with pd_get_event_enrichment first and send back what you want to keep. The enrichment's RULES and its service and orchestration ASSOCIATIONS are untouched here: they live behind separate tools. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. PUT /enrichment/event_enrichments/. Path parameters: id. Send the request body as JSON with event_enrichment: name, description and/or team.id. Every other field PagerDuty returns on the object is read-only. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update Event Enrichment rules. Why this is destructive: it REPLACES the enrichment's whole rule set: rules you leave out are removed, the fields they were adding stop appearing on live events, and PagerDuty keeps no prior version. Read the current rules with pd_list_event_enrichment_rules and send them back with your edit. EARLY ACCESS: PagerDuty documents this API as Early Access and it can change at any time. Access is granted per account - contact your PagerDuty account team - and an account that has not been granted it answers 403. No header is sent: this group declares none. PUT /enrichment/event_enrichments//rules. Path parameters: id. Send the request body as JSON with orchestration_path.sets - an array of rule sets, one of which MUST have id start. Each rule carries label, conditions (each one a PCL expression), optional disabled, and actions, which is EITHER extractions (target plus template, or source plus a RE2 regex; at most 25 per rule) OR enrichments (schema_to_search, search_values and target; at most one per rule). Returns raw PagerDuty JSON.

[PagerDuty] Create an escalation policy. Not destructive: additive: a new policy pages nobody until a service is pointed at it, and deleting it is a separate tool. POST /escalation_policies. Send the request body as JSON; PagerDuty documents these fields: escalation_policy.type, escalation_policy.name, escalation_policy.description, escalation_policy.num_loops, escalation_policy.on_call_handoff_notifications, escalation_policy.escalation_rules, escalation_policy.services, escalation_policy.teams. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an escalation policy. Why this is destructive: it deletes the record and PagerDuty keeps no copy. DELETE /escalation_policies/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get an escalation policy. GET /escalation_policies/. Path parameters: id. Optional filters: include[]. Returns raw PagerDuty JSON.

[PagerDuty] List escalation policies. GET /escalation_policies. Optional filters: query, user_ids[], team_ids[], include[], sort_by. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] List audit records for an escalation policy. GET /escalation_policies//audit/records. Path parameters: id. Optional filters: since, until. Paged with an opaque cursor: pass the previous response next_cursor value back as cursor. A null next_cursor means there are no more pages. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update an escalation policy. Why this is destructive: PagerDuty replaces the rule set with what you send, so omitting rules removes them and nobody is escalated to at those levels. Send the COMPLETE escalation_rules list. The policy can be edited again, but only after you have read the current rules back. PUT /escalation_policies/. Path parameters: id. Send the request body as JSON; PagerDuty documents these fields: escalation_policy.type, escalation_policy.name, escalation_policy.description, escalation_policy.num_loops, escalation_policy.on_call_handoff_notifications, escalation_policy.escalation_rules, escalation_policy.services, escalation_policy.teams. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: create an Orchestration. Why this is destructive: it MINTS a routing key. PagerDuty creates a Default Integration with the new orchestration and its 201 response carries that integration's live 32-character routing_key, which can open incidents on this account from anywhere. The orchestration itself routes nothing until a monitoring tool starts sending to that key and pd_update_orchestration_router_path gives it rules. POST /event_orchestrations. The request body as JSON: { "orchestration": { "name": "...", "description": "...", "team": { "id": "PXXXXXX" } } }. Only name, description and team are writable; id, self, integrations, routes, created_at, created_by, updated_at, updated_by and version are read-only and are ignored on the way in. Omitting team leaves the orchestration accessible to admins only. Returns raw PagerDuty JSON.

[PagerDuty] Create a Cache Variable for a Global Event Orchestration. Not destructive: additive: a new cache variable is evaluated but nothing reads it until a rule names it. A Cache Variable remembers something across events - the most recent value matched out of an event (recent_value), how many trigger events arrived in a window (trigger_event_count), or a value pushed in through the API (external_data) - and live orchestration rules match on it. POST /event_orchestrations//cache_variables. Path parameters: id. The request body as JSON: { "cache_variable": { "name": "...", "disabled": false, "conditions": [ { "expression": "..." } ], "configuration": } }. configuration.type picks the shape: recent_value takes source and regex, trigger_event_count takes ttl_seconds, external_data takes data_type (string, number or boolean) and ttl_seconds. id, created_at, created_by, updated_at and updated_by are read-only and are ignored on the way in. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: create an Integration for an Event Orchestration. Why this is destructive: it MINTS a routing key that can open incidents on this account from anywhere, and the 201 response returns that live 32-character routing_key. Treat the result as a credential: anyone holding the key can page this account's on-call through pd_send_event. POST /event_orchestrations//integrations. Path parameters: id. The request body as JSON: { "integration": { "label": "..." } }. label is the only writable field and it is required; id and parameters.routing_key are read-only and are what PagerDuty hands back. Returns raw PagerDuty JSON.

[PagerDuty] Create a Cache Variable for a Service Event Orchestration. Not destructive: additive: a new cache variable is evaluated but nothing reads it until a rule on this service's orchestration names it. A Cache Variable remembers something across events - the most recent value matched out of an event (recent_value), how many trigger events arrived in a window (trigger_event_count), or a value pushed in through the API (external_data) - and live orchestration rules match on it. POST /event_orchestrations/services//cache_variables. Path parameters: service_id. The request body as JSON: { "cache_variable": { "name": "...", "disabled": false, "conditions": [ { "expression": "..." } ], "configuration": } }. configuration.type picks the shape: recent_value takes source and regex, trigger_event_count takes ttl_seconds, external_data takes data_type (string, number or boolean) and ttl_seconds. id, created_at, created_by, updated_at and updated_by are read-only and are ignored on the way in. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an Orchestration. Why this is destructive: deleting an Event Orchestration destroys its Router, Global and Unrouted rule sets and every integration created on it, so every routing key it issued stops routing and the monitoring tools still sending to those keys are silently dropped. PagerDuty keeps no copy. DELETE /event_orchestrations/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete a Cache Variable for a Global Event Orchestration. Why this is destructive: the variable and its stored value are gone and any live orchestration rule that matches on it stops finding it, so those rules stop firing from the next event onward. DELETE /event_orchestrations//cache_variables/. Path parameters: id, cache_variable_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete Data for an External Data Cache Variable on a Global Event Orchestration. Why this is destructive: the external-data value live orchestration rules are matching on is cleared, so every rule that tests it behaves differently from the next event onward. The variable itself survives; only its value is gone, and only a new pd_set_orchestration_cache_variable_data call restores one. DELETE /event_orchestrations//cache_variables//data. Path parameters: id, cache_variable_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an Integration for an Event Orchestration. Why this is destructive: the routing key that integration issued stops working immediately, and every monitoring tool still sending events to it is silently dropped - no incident opens and nobody is paged. PagerDuty does not re-issue the same key, so recovery means creating a new integration and reconfiguring every tool that used the old one. DELETE /event_orchestrations//integrations/. Path parameters: id, integration_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete Data for an External Data Cache Variable on a Service Event Orchestration. Why this is destructive: the external-data value live rules on this service's orchestration are matching on is cleared, so every rule that tests it behaves differently from the next event onward. The variable itself survives; only its value is gone, and only a new pd_set_service_orchestration_cache_var_data call restores one. DELETE /event_orchestrations/services//cache_variables//data. Path parameters: service_id, cache_variable_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete a Cache Variable for a Service Event Orchestration. Why this is destructive: the variable and its stored value are gone and any live rule on this service's orchestration that matches on it stops finding it, so those rules stop firing from the next event onward. DELETE /event_orchestrations/services//cache_variables/. Path parameters: service_id, cache_variable_id. Returns raw PagerDuty JSON.

[PagerDuty] Get an Orchestration. The response is the FULL Orchestration object, and its integrations member carries each integration's live 32-character routing KEY (Orchestration.integrations[].parameters.routing_key), which can open incidents on this account from anywhere - handle the result as a credential. The routing RULES are separate reads: pd_get_orchestration_router_path, pd_get_orchestration_global_path and pd_get_orchestration_unrouted_path. GET /event_orchestrations/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get a Cache Variable for a Global Event Orchestration. A Cache Variable remembers something across events - the most recent value matched out of an event (recent_value), how many trigger events arrived in a window (trigger_event_count), or a value pushed in through the API (external_data) - and live orchestration rules match on it. configuration.type says which of the three this one is, and disabled says whether rules are still evaluating it. GET /event_orchestrations//cache_variables/. Path parameters: id, cache_variable_id. Returns raw PagerDuty JSON.

[PagerDuty] Get Data for an External Data Cache Variable on a Global Event Orchestration. Reads the CURRENT VALUE of an external_data type Cache Variable - the value live orchestration rules are matching on right now. Only external_data variables have data, and PagerDuty drops the value once the variable's ttl_seconds has passed. GET /event_orchestrations//cache_variables//data. Path parameters: id, cache_variable_id. Returns raw PagerDuty JSON.

[PagerDuty] Get the Global Orchestration for an Event Orchestration. The Global rules run on the events this orchestration receives. There is at least a start set and rules may route to further sets to form a directional graph; catch_all.actions (suppress, suspend, drop_event, severity, priority, annotate and the rest) applies when no rule matched. GET /event_orchestrations//global. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get an Integration for an Event Orchestration. The response carries the integration's live 32-character routing KEY (integration.parameters.routing_key), which can open incidents on this account from anywhere - handle the result as a credential. This is the key a monitoring tool sends events to; pd_send_event is the tool that uses one. GET /event_orchestrations//integrations/. Path parameters: id, integration_id. Returns raw PagerDuty JSON.

[PagerDuty] Get the Router for an Event Orchestration. The Router is the first thing an event meets. PagerDuty's own words: it contains a single start set, evaluates events against those rules one at a time and routes each event to a specific Service on the first rule that matches; catch_all.actions.route_to with the value unrouted sends everything else to the Unrouted Orchestration. Read this before changing anything - pd_update_orchestration_router_path REPLACES the whole set. GET /event_orchestrations//router. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get the Unrouted Orchestration for an Event Orchestration. The Unrouted Orchestration handles the events the Router matched no rule for - what the Router's catch_all sends here. Same shape as the other paths: at least a start set, plus catch_all actions for events no unrouted rule matched. GET /event_orchestrations//unrouted. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get the Service Orchestration active status for a Service. Answers whether the service's Event Orchestration is switched on. While it is off, events reaching the service are handled by the service's default behaviour instead of these rules - so a rule set that looks wrong may simply be inactive. GET /event_orchestrations/services//active. Path parameters: service_id. Returns raw PagerDuty JSON.

[PagerDuty] Get Data for an External Data Cache Variable on a Service Event Orchestration. Reads the CURRENT VALUE of an external_data type Cache Variable on a service's orchestration - the value live rules are matching on right now. Only external_data variables have data, and PagerDuty drops the value once the variable's ttl_seconds has passed. GET /event_orchestrations/services//cache_variables//data. Path parameters: service_id, cache_variable_id. Returns raw PagerDuty JSON.

[PagerDuty] Get a Cache Variable for a Service Event Orchestration. A Cache Variable remembers something across events - the most recent value matched out of an event (recent_value), how many trigger events arrived in a window (trigger_event_count), or a value pushed in through the API (external_data) - and live orchestration rules match on it. configuration.type says which of the three this one is, and disabled says whether rules are still evaluating it. GET /event_orchestrations/services//cache_variables/. Path parameters: service_id, cache_variable_id. Returns raw PagerDuty JSON.

[PagerDuty] Get the Service Orchestration for a Service. A Service Orchestration is the rule set belonging to ONE service, applied after the Global Orchestration's Router has routed the event to it. Its catch_all actions can suppress, suspend, re-prioritise, re-route the escalation policy or annotate whatever matched no rule. GET /event_orchestrations/services/. Path parameters: service_id. Optional filters: include[]. Returns raw PagerDuty JSON.

[PagerDuty] List Enablements for an Event Orchestration. Feature enablements are the product add-ons switched on for this orchestration. PagerDuty currently documents exactly one, aiops, and the response carries any warnings that apply to it. PagerDuty declares no limit, offset or cursor on this endpoint, so the whole collection comes back in one response and StackJack invents no page parameters. GET /event_orchestrations//enablements. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] List Event Orchestrations. A Global Event Orchestration is the account-level routing layer an event meets BEFORE any service: its Router decides which service each event lands on (pd_get_orchestration_router_path) and its Unrouted path handles what no route matched (pd_get_orchestration_unrouted_path). These rows carry NO routing keys - the per-orchestration read pd_get_orchestration returns those. GET /event_orchestrations. Optional filters: sort_by. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] List Cache Variables for a Global Event Orchestration. A Cache Variable remembers something across events - the most recent value matched out of an event (recent_value), how many trigger events arrived in a window (trigger_event_count), or a value pushed in through the API (external_data) - and live orchestration rules match on it. PagerDuty declares no limit, offset or cursor on this endpoint, so the whole collection comes back in one response and StackJack invents no page parameters. GET /event_orchestrations//cache_variables. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] List Integrations for an Event Orchestration. The response carries each integration's live 32-character routing KEY (integrations[].parameters.routing_key), which can open incidents on this account from anywhere - handle the result as a credential. PagerDuty declares no limit, offset or cursor on this endpoint, so the whole collection comes back in one response and StackJack invents no page parameters. GET /event_orchestrations//integrations. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] List Cache Variables for a Service Event Orchestration. A Cache Variable remembers something across events - the most recent value matched out of an event (recent_value), how many trigger events arrived in a window (trigger_event_count), or a value pushed in through the API (external_data) - and live orchestration rules match on it. PagerDuty declares no limit, offset or cursor on this endpoint, so the whole collection comes back in one response and StackJack invents no page parameters. GET /event_orchestrations/services//cache_variables. Path parameters: service_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: migrate an Integration from one Event Orchestration to another. Why this is destructive: it moves an integration - and the routing key already deployed in the customer's monitoring tools - from the orchestration named in the body to the one named in the URL, so events sent to that key are routed by the DESTINATION orchestration's rules from the moment it lands. PagerDuty publishes no reverse migration: undoing it means migrating back and hoping the source orchestration still exists. The response lists the destination's integrations with their live routing keys, so handle the result as a credential. POST /event_orchestrations//integrations/migration. Path parameters: id. The request body as JSON: { "source_id": "<orchestration id the integration is moving FROM>", "source_type": "orchestration", "integration_id": "<the integration being moved>" }. All three are required and source_type is pinned to orchestration. The DESTINATION is the id in the URL, not in the body. Returns raw PagerDuty JSON.

[PagerDuty] Update Data for an External Data Cache Variable on a Global Event Orchestration. Not destructive: this endpoint exists to be called repeatedly - it pushes the current value of an external_data cache variable and can be pushed again, and PagerDuty expires the value after the variable's ttl_seconds anyway. Live orchestration rules match on that value, so the change takes effect on the next event. PUT /event_orchestrations//cache_variables//data. Path parameters: id, cache_variable_id. The request body as JSON: { "cache_variable_data": <value> }, where <value> is a string, a number or a boolean matching the variable's declared data_type. Only an external_data type Cache Variable has data; PagerDuty keeps the value for the variable's ttl_seconds and then drops it. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update the Service Orchestration active status for a Service. Why this is destructive: switching a service's Event Orchestration off returns every incoming event to the service's default handling, which changes what is suppressed, what is escalated and who is paged from the next event onward. The rules are not deleted - switching it back on restores them. PUT /event_orchestrations/services//active. Path parameters: service_id. The request body as JSON: { "active": true } or { "active": false }. active is the only field this endpoint takes. Returns raw PagerDuty JSON.

[PagerDuty] Update Data for an External Data Cache Variable on a Service Event Orchestration. Not destructive: this endpoint exists to be called repeatedly - it pushes the current value of an external_data cache variable on a service's orchestration and can be pushed again, and PagerDuty expires the value after the variable's ttl_seconds anyway. Live rules match on that value, so the change takes effect on the next event. PUT /event_orchestrations/services//cache_variables//data. Path parameters: service_id, cache_variable_id. The request body as JSON: { "cache_variable_data": <value> }, where <value> is a string, a number or a boolean matching the variable's declared data_type. Only an external_data type Cache Variable has data; PagerDuty keeps the value for the variable's ttl_seconds and then drops it. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update an Enablement for an Event Orchestration. Why this is destructive: it turns a whole product add-on on or off for this Event Orchestration, which changes how every event flowing through it is processed - switching aiops off stops the AIOps features its rules depend on and the response may return warnings explaining what is now ineligible. PUT /event_orchestrations//enablements/. Path parameters: id, feature_name. The request body as JSON: { "enablement": { "enabled": true } }. enabled is the only writable field; feature, updated_at and warnings are read-only. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update an Orchestration. Why this is destructive: the PUT REPLACES the stored orchestration with the object you send, and team is the ACCESS CONTROL on it: leave team out and PagerDuty removes the team that owns this orchestration, after which - in PagerDuty's own words - only admins have access to routing that is still live. name and description go the same way, and PagerDuty keeps no prior version. The routing RULES are untouched here: they live behind pd_update_orchestration_router_path, pd_update_orchestration_global_path and pd_update_orchestration_unrouted_path. Read the object with pd_get_orchestration first and send back what you want to keep; the response returns every integration's live routing key. PUT /event_orchestrations/. Path parameters: id. The request body as JSON: { "orchestration": { "name": "...", "description": "...", "team": { "id": "PXXXXXX" } } }. Only those three are writable; id, self, integrations, routes, created_at, created_by, updated_at, updated_by and version are read-only and are ignored on the way in. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update a Cache Variable for a Global Event Orchestration. Why this is destructive: the PUT replaces the whole definition, so a name, condition or configuration field you leave out is gone - send every field you want to keep. Live orchestration rules MATCH on this variable, so a changed name, condition or configuration changes how events are handled from the next event onward. No incident or notification already raised is touched and the variable can be edited again. PUT /event_orchestrations//cache_variables/. Path parameters: id, cache_variable_id. The request body as JSON: { "cache_variable": { "name": "...", "disabled": false, "conditions": [ { "expression": "..." } ], "configuration": } }. configuration.type picks the shape: recent_value takes source and regex, trigger_event_count takes ttl_seconds, external_data takes data_type (string, number or boolean) and ttl_seconds. id, created_at, created_by, updated_at and updated_by are read-only and are ignored on the way in. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update the Global Orchestration for an Event Orchestration. Why this is destructive: it REPLACES the global rule set wholesale: sets and rules you leave out are removed, so events stop being suppressed, suspended, dropped or re-prioritised the way they were from the next event onward, and PagerDuty keeps no prior version. Read pd_get_orchestration_global_path first and send back everything you want to keep. PUT /event_orchestrations//global. Path parameters: id. The request body as JSON: { "orchestration_path": { "type": "global", "parent": { "id": "<orchestration id>", "type": "event_orchestration_reference" }, "sets": [ ... ], "catch_all": { "actions": } } }. sets[] holds the rule sets (at least one named start) and each rule carries conditions[].expression and actions; catch_all.actions applies to events no rule matched. Send the COMPLETE set - created_at, created_by, updated_at, updated_by and version are read-only. Returns raw PagerDuty JSON.

[PagerDuty] Update an Integration for an Event Orchestration. Not destructive: it renames the integration and nothing else - the routing key it already issued is unchanged and every monitoring tool sending to it keeps working. The response still carries that live routing key, so handle the result as a credential. PUT /event_orchestrations//integrations/. Path parameters: id, integration_id. The request body as JSON: { "integration": { "label": "..." } }. label is the only writable field; id and parameters.routing_key are read-only. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update the Router for an Event Orchestration. Why this is destructive: the Router decides which SERVICE each incoming event lands on, and this REPLACES its whole rule set: rules you leave out are removed and events start landing on a different service - or on nothing but the Unrouted Orchestration - from the next event onward, with no prior version kept. Read pd_get_orchestration_router_path first and send back everything you want to keep. PUT /event_orchestrations//router. Path parameters: id. The request body as JSON: { "orchestration_path": { "type": "router", "parent": { "id": "<orchestration id>", "type": "event_orchestration_reference" }, "sets": [ { "id": "start", "rules": [ ... ] } ], "catch_all": { "actions": { "route_to": "unrouted" } } } }. The Router has a single start set, evaluated one rule at a time, and each rule's actions carry route_to with the target service ID. sets[] holds the rule sets (at least one named start) and each rule carries conditions[].expression and actions; catch_all.actions applies to events no rule matched. Send the COMPLETE set - created_at, created_by, updated_at, updated_by and version are read-only. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update the Unrouted Orchestration for an Event Orchestration. Why this is destructive: it REPLACES the whole rule set that handles events the Router matched nothing for: rules you leave out are removed and unrouted events are handled differently from the next event onward, with no prior version kept. Read pd_get_orchestration_unrouted_path first and send back everything you want to keep. PUT /event_orchestrations//unrouted. Path parameters: id. The request body as JSON: { "orchestration_path": { "type": "unrouted", "parent": { "id": "<orchestration id>", "type": "event_orchestration_reference" }, "sets": [ ... ], "catch_all": { "actions": } } }. sets[] holds the rule sets (at least one named start) and each rule carries conditions[].expression and actions; catch_all.actions applies to events no rule matched. Send the COMPLETE set - created_at, created_by, updated_at, updated_by and version are read-only. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update a Cache Variable for a Service Event Orchestration. Why this is destructive: the PUT replaces the whole definition, so a name, condition or configuration field you leave out is gone - send every field you want to keep. Live rules on this service's orchestration MATCH on this variable, so a changed name, condition or configuration changes how events are handled from the next event onward. No incident or notification already raised is touched and the variable can be edited again. PUT /event_orchestrations/services//cache_variables/. Path parameters: service_id, cache_variable_id. The request body as JSON: { "cache_variable": { "name": "...", "disabled": false, "conditions": [ { "expression": "..." } ], "configuration": } }. configuration.type picks the shape: recent_value takes source and regex, trigger_event_count takes ttl_seconds, external_data takes data_type (string, number or boolean) and ttl_seconds. id, created_at, created_by, updated_at and updated_by are read-only and are ignored on the way in. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update the Service Orchestration for a Service. Why this is destructive: it REPLACES a service's whole Event Orchestration rule set: rules you leave out are removed, so events that were being suppressed, suspended, re-prioritised, annotated or sent to a different escalation policy stop being, from the next event onward, and PagerDuty keeps no prior version. Read pd_get_service_orchestration_path first and send back everything you want to keep. PUT /event_orchestrations/services/. Path parameters: service_id. The request body as JSON: { "orchestration_path": { "type": "service", "parent": { "id": "<service id>", "type": "service_reference" }, "sets": [ ... ], "catch_all": { "actions": } } }. catch_all.actions takes suppress, suspend, priority, escalation_policy, annotate, severity, event_action, variables, extractions, pagerduty_automation_actions, automation_actions and incident_custom_field_updates. sets[] holds the rule sets (at least one named start) and each rule carries conditions[].expression and actions; catch_all.actions applies to events no rule matched. Send the COMPLETE set - created_at, created_by, updated_at, updated_by and version are read-only. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: accept a recommended rule. Why this is destructive: accepting WRITES the recommended rule into the service's LIVE Event Orchestration, so matching events are suppressed, re-prioritised or re-severitied from the next event onward - this is a routing change, not a bookmark. It takes no request body; the recommendation_id in the URL is the rule instance hash from pd_list_recommended_rules, and pd_delete_accepted_recommended_rule is how you take it back out. POST /recommendations/event_orchestrations/services//rules//accept. Path parameters: service_id, recommendation_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an accepted rule. Why this is destructive: the rule is removed from the service's LIVE Event Orchestration, so events it was suppressing, re-prioritising or re-severitying are handled by whatever matches next, from the next event onward. The recommendation returns to pd_list_recommended_rules; the rule itself is gone. DELETE /recommendations/event_orchestrations/services//accepted_rules/. Path parameters: service_id, rule_id. Returns raw PagerDuty JSON.

[PagerDuty] Dismiss a recommended rule. Not destructive: it hides a suggestion and records whether it was useful: no rule is written, no event routes differently, and nothing about the service's live orchestration changes. POST /recommendations/event_orchestrations/services//rules//dismiss. Path parameters: service_id, recommendation_id. The request body as JSON: { "decision": { "feedback": "positive" } } or { "decision": { "feedback": "negative" } }. feedback is required and PagerDuty accepts only those two values. Returns raw PagerDuty JSON.

[PagerDuty] List recommended rules. PagerDuty's AI proposes Service Event Orchestration rules from the account's own alert history - each row is a SUGGESTION that has not been applied. pd_accept_recommended_rule writes one into the service's live orchestration and pd_dismiss_recommended_rule hides it with feedback. GET /recommendations/event_orchestrations/rules. Optional filters: service_id, service_ids[], team_ids[], actions[]. Paged with an opaque cursor: pass the previous response next_cursor value back as cursor. A null next_cursor means there are no more pages. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: create a Ruleset. Why this is destructive: the 201 response hands back a live routing key. PagerDuty's own example for this endpoint returns the new ruleset already carrying a 32-character key in routing_keys, and routing_keys is read-only, so the caller cannot have supplied it - anyone holding that key can open incidents on this account from anywhere. What the spec does NOT settle is whether this call creates the key or whether the example is the Ruleset object example reused from the read, so StackJack takes the cautious verdict rather than shipping it as a routine additive create. Nothing existing is changed, and the ruleset routes nothing until Event Rules are added with pd_create_ruleset_event_rule. END OF LIFE: PagerDuty's own description of this endpoint warns that Rulesets and Event Rules will end-of-life soon and names Event Orchestration as the replacement - build new routing with pd_create_orchestration and pd_update_orchestration_router_path, and treat these ten tools as migration and read-out only. POST /rulesets. The request body as JSON: { "ruleset": { "name": "...", "team": { "id": "PXXXXXX", "type": "team_reference" } } }. name is required; team is optional and, when it is omitted, only admins have access. id, self, type, routing_keys, created_at, creator, updated_at and updater are read-only. Returns raw PagerDuty JSON.

[PagerDuty] Create an Event Rule. Not destructive: additive: it adds one rule to the ruleset. It takes effect on the next matching event and its position decides evaluation order - rules run from position 0 downward and the first match wins, so place it deliberately. END OF LIFE: PagerDuty's own description of this endpoint warns that Rulesets and Event Rules will end-of-life soon and names Event Orchestration as the replacement - build new routing with pd_create_orchestration and pd_update_orchestration_router_path, and treat these ten tools as migration and read-out only. POST /rulesets//rules. Path parameters: id. The request body as JSON: { "rule": { "disabled": false, "position": 0, "conditions": { "operator": "and", "subconditions": [ ... ] }, "time_frame": , "actions": } }. conditions.operator (and / or) and conditions.subconditions are required together; actions takes annotate, event_action, extractions, priority, severity, suppress, suspend and route (the target service ID). id, self and catch_all are read-only. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete a Ruleset. Why this is destructive: deleting a ruleset destroys every Event Rule in it and the integration keys feeding it stop being processed, so events that were being suppressed, routed or re-prioritised are handled as raw events from the next event onward. PagerDuty keeps no copy. END OF LIFE: PagerDuty's own description of this endpoint warns that Rulesets and Event Rules will end-of-life soon and names Event Orchestration as the replacement - build new routing with pd_create_orchestration and pd_update_orchestration_router_path, and treat these ten tools as migration and read-out only. DELETE /rulesets/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an Event Rule. Why this is destructive: events that were matching this rule are handled by whatever matches next - or by the ruleset's catch_all - from the next event onward, so alerts that were being suppressed can start opening incidents. PagerDuty keeps no copy. END OF LIFE: PagerDuty's own description of this endpoint warns that Rulesets and Event Rules will end-of-life soon and names Event Orchestration as the replacement - build new routing with pd_create_orchestration and pd_update_orchestration_router_path, and treat these ten tools as migration and read-out only. DELETE /rulesets//rules/. Path parameters: id, rule_id. Returns raw PagerDuty JSON.

[PagerDuty] Get a Ruleset. The response carries this ruleset's routing_keys - the live 32-character keys routed to it - so handle the result as a credential. END OF LIFE: PagerDuty's own description of this endpoint warns that Rulesets and Event Rules will end-of-life soon and names Event Orchestration as the replacement - build new routing with pd_create_orchestration and pd_update_orchestration_router_path, and treat these ten tools as migration and read-out only. GET /rulesets/. Path parameters: id. Returns raw PagerDuty JSON.

[PagerDuty] Get an Event Rule. conditions says what the rule matches, actions says what it does to the resulting alert or incident, position decides when it is evaluated, and disabled says whether it is evaluated at all. END OF LIFE: PagerDuty's own description of this endpoint warns that Rulesets and Event Rules will end-of-life soon and names Event Orchestration as the replacement - build new routing with pd_create_orchestration and pd_update_orchestration_router_path, and treat these ten tools as migration and read-out only. GET /rulesets//rules/. Path parameters: id, rule_id. Returns raw PagerDuty JSON.

[PagerDuty] List Event Rules. Event Rules are evaluated in position order, starting at position 0, and the last rule of a ruleset is its read-only catch_all. Read the order here before inserting anything with pd_create_ruleset_event_rule. END OF LIFE: PagerDuty's own description of this endpoint warns that Rulesets and Event Rules will end-of-life soon and names Event Orchestration as the replacement - build new routing with pd_create_orchestration and pd_update_orchestration_router_path, and treat these ten tools as migration and read-out only. GET /rulesets//rules. Path parameters: id. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] List Rulesets. A Ruleset is the LEGACY event-routing surface: integration keys feed a ruleset and its Event Rules decide what happens. The response carries each ruleset's routing_keys - the live 32-character keys routed to it - so handle the result as a credential. END OF LIFE: PagerDuty's own description of this endpoint warns that Rulesets and Event Rules will end-of-life soon and names Event Orchestration as the replacement - build new routing with pd_create_orchestration and pd_update_orchestration_router_path, and treat these ten tools as migration and read-out only. GET /rulesets. Paged with limit and offset: limit caps at 100. PagerDuty REFUSES any request whose offset plus limit exceeds 10000 - it answers 400 rather than an empty page - so narrow by date, team or service instead of paging past that. The response total is null unless explicitly requested and StackJack never requests it (PagerDuty documents it as slow); drive a loop off the more flag. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update a Ruleset. Why this is destructive: the body carries the whole ruleset and the PUT REPLACES the stored one, and team is the ACCESS CONTROL on it: leave team out and PagerDuty removes the owning team, after which only admins have access to a ruleset that is still routing live events. PagerDuty keeps no prior version, so read it with pd_get_ruleset first and send back what you want to keep. routing_keys is read-only and this call does not change it, but the response returns those live 32-character keys, so handle the result as a credential. END OF LIFE: PagerDuty's own description of this endpoint warns that Rulesets and Event Rules will end-of-life soon and names Event Orchestration as the replacement - build new routing with pd_create_orchestration and pd_update_orchestration_router_path, and treat these ten tools as migration and read-out only. PUT /rulesets/. Path parameters: id. The request body as JSON: { "ruleset": { "name": "...", "team": { "id": "PXXXXXX", "type": "team_reference" } } }. Only name and team are writable; id, self, type, routing_keys, created_at, creator, updated_at and updater are read-only and are ignored on the way in. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: update an Event Rule. Why this is destructive: it edits a LIVE routing rule. PagerDuty documents this endpoint as supporting PARTIAL updates, so a field you omit keeps its stored value - but every field you do send replaces the stored one outright, and a changed condition, action or position changes what matches from the next event onward: an alert that was being suppressed can start opening incidents and paging the on-call. position also re-orders evaluation, which can change what matches before this rule is reached, and PagerDuty keeps no prior version. END OF LIFE: PagerDuty's own description of this endpoint warns that Rulesets and Event Rules will end-of-life soon and names Event Orchestration as the replacement - build new routing with pd_create_orchestration and pd_update_orchestration_router_path, and treat these ten tools as migration and read-out only. PUT /rulesets//rules/. Path parameters: id, rule_id. The request body as JSON: { "rule": { "disabled": false, "position": 0, "conditions": { "operator": "and", "subconditions": [ ... ] }, "time_frame": , "actions": } }. PagerDuty documents partial updates here, so send only the writable fields you are changing - but a collection you do send (conditions.subconditions, actions) replaces the stored one, so read the rule with pd_get_ruleset_event_rule first. id, self and catch_all are read-only. Returns raw PagerDuty JSON.

[PagerDuty] Send change events to the PagerDuty Events API. Not destructive: a change event is timeline context, not an alert: it opens no incident and pages nobody. It is used for change correlation on incidents that open later. The routing_key is a per-SERVICE Events API v2 integration key the customer creates in PagerDuty (Service, then Integrations, then Add an integration, then Events API v2). StackJack does NOT store it: it is a call argument, it is not the REST API key this connector is configured with, and the two are not interchangeable. POST /v2/change/enqueue. Send the request body as JSON; PagerDuty documents these fields: payload.summary, payload.timestamp, payload.source, payload.custom_details, routing_key, links, images. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: send an event to PagerDuty. Why this is destructive: a trigger event OPENS A REAL INCIDENT on the service the routing key belongs to and pages whoever is on call for it, through every channel their notification rules name; an acknowledge or resolve event changes a live incident the same way. The routing_key is a per-SERVICE Events API v2 integration key the customer creates in PagerDuty (Service, then Integrations, then Add an integration, then Events API v2). StackJack does NOT store it: it is a call argument, it is not the REST API key this connector is configured with, and the two are not interchangeable. POST /v2/enqueue. Send the request body as JSON; PagerDuty documents these fields: payload.summary, payload.timestamp, payload.severity, payload.source, payload.component, payload.group, payload.class, payload.custom_details, routing_key, event_action, dedup_key, client, client_url, links, images. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: send an event to PagerDuty. Why this is destructive: a trigger event OPENS A REAL INCIDENT on the service the service key belongs to and pages whoever is on call for it. This is the DEPRECATED Events API v1 - new integrations should use pd_send_event (Events API v2). The service_key is the per-service Events API v1 integration key, supplied per call and never stored by StackJack. POST /generic/2010-04-15/create_event.json. Send the request body as JSON; PagerDuty documents these fields: service_key, event_type, incident_key, description, details, client, client_url, contexts. Returns raw PagerDuty JSON.

[PagerDuty] Create an account-level incident custom field (Base Incident Type). Not destructive: additive: the new field holds no values until one is set on an incident, and nothing about existing incidents changes. This deprecated endpoint only creates fields on the Base Incident Type; the replacement is pd_create_incident_type_custom_field. DEPRECATED: PagerDuty flags this operation deprecated in its own API document; prefer the current equivalent where one exists, and expect it to be withdrawn. POST /incidents/custom_fields. Wrap the field in a field object. PagerDuty's own sample for this endpoint is {"field": {"name": "environment", "display_name": "Environment", "description": "The environment that the issue occurred in", "data_type": "string", "field_type": "single_value_fixed", "default_value": "production", "field_options": [{"data": {"data_type": "string", "value": "production"}}]}}. field_options may only be supplied for a field_type ending in _fixed. The schema ALSO lists the server-assigned id, self, summary, type, namespace, created_at and updated_at in its required array; the vendor sample sends none of them, so send only the fields above. Returns raw PagerDuty JSON.

[PagerDuty] Add a selectable option to an account-level custom field. Not destructive: additive: a new option becomes selectable but is not set on any incident until someone chooses it. This deprecated endpoint only reaches fields on the Base Incident Type; the replacement is pd_create_incident_type_custom_field_option. DEPRECATED: PagerDuty flags this operation deprecated in its own API document; prefer the current equivalent where one exists, and expect it to be withdrawn. POST /incidents/custom_fields//field_options. Path parameters: field_id. Wrap the option in a field_option object. PagerDuty's own sample is {"field_option": {"data": {"data_type": "string", "value": "production"}}}. Options can only be added to a field whose field_type ends in _fixed. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete an account-level incident custom field definition. Why this is destructive: deleting the field destroys the values recorded against it on every incident that carried it and PagerDuty keeps no copy. This deprecated endpoint only reaches fields on the Base Incident Type; the replacement is pd_delete_incident_type_custom_field. DEPRECATED: PagerDuty flags this operation deprecated in its own API document; prefer the current equivalent where one exists, and expect it to be withdrawn. DELETE /incidents/custom_fields/. Path parameters: field_id. Returns raw PagerDuty JSON.

[PagerDuty] DESTRUCTIVE: delete one selectable option of an account-level custom field. Why this is destructive: every incident that had this option selected loses that value and PagerDuty keeps no copy. This deprecated endpoint only reaches fields on the Base Incident Type; the replacement is pd_delete_incident_type_custom_field_field_option. DEPRECATED: PagerDuty flags this operation deprecated in its own API document; prefer the current equivalent where one exists, and expect it to be withdrawn. DELETE /incidents/custom_fields//field_options/. Path parameters: field_id, field_option_id. Returns raw PagerDuty JSON.

[PagerDuty] Get an account-level incident custom field definition (Base Incident Type). This returns the field's DEFINITION - name, data type, field type, default, enabled - and NOT what any incident holds in it: pd_get_incident_custom_field_values reads an incident's values. This deprecated endpoint only sees fields on the Base Incident Type; the replacement is pd_get_incident_type_custom_field. DEPRECATED: PagerDuty flags this operation deprecated in its own API document; prefer the current equivalent where one exists, and expect it to be withdrawn. GET /incidents/custom_fields/. Path parameters: field_id. Optional filters: include[]. Returns raw PagerDuty JSON.

[PagerDuty] List the selectable options of an account-level custom field. Only a field whose field_type ends in _fixed has options. This deprecated endpoint only sees fields on the Base Incident Type; the replacement is pd_list_incident_type_custom_field_options. PagerDuty declares no paging parameters on this endpoint, so the whole collection comes back in one response. DEPRECATED: PagerDuty flags this operation deprecated in its own API document; prefer the current equivalent where one exists, and expect it to be withdrawn. GET /incidents/custom_fields//field_options. Path parameters: field_id. Returns raw PagerDuty JSON.

[PagerDuty] List account-level incident custom field definitions (Base Incident Type). This deprecated endpoint only sees fields on the Base Incident Type; the replacement is pd_list_incident_type_custom_fields, which lists the fields of any incident type. These are the field DEFINITIONS; pd_get_incident_custom_field_values reads the VALUES one incident holds in its fields. PagerDuty declares no paging parameters on this endpoint, so the whole collection comes back in one response. DEPRECATED: PagerDuty flags this operation deprecated in its own API document; prefer the current equivalent where one exists, and expect it to be withdrawn. GET /incidents/custom_fields. Optional filters: include[]. Returns raw PagerDuty JSON.

[PagerDuty] Update an account-level incident custom field definition. Not destructive: it edits only display_name, description, default_value and enabled - PagerDuty's schema exposes nothing else here - and the values already recorded on incidents are untouched. This deprecated endpoint only reaches fields on the Base Incident Type; the replacement is pd_update_incident_type_custom_field. DEPRECATED: PagerDuty flags this operation deprecated in its own API document; prefer the current equivalent where one exists, and expect it to be withdrawn. PUT /incidents/custom_fields/. Path parameters: field_id. Wrap the changes in a field object; PagerDuty documents display_name, description, default_value and enabled: {"field": {"display_name": "Environment", "enabled": true}}. Returns raw PagerDuty JSON.

[PagerDuty] Update one selectable option of an account-level custom field. Not destructive: it rewrites one option's value, and every incident already carrying that option reads the new text - the change is retroactive across existing incidents - but nothing is deleted and writing the old value back undoes it. This deprecated endpoint only reaches fields on the Base Incident Type; the replacement is pd_update_incident_type_custom_field_field_option. DEPRECATED: PagerDuty flags this operation deprecated in its own API document; prefer the current equivalent where one exists, and expect it to be withdrawn. PUT /incidents/custom_fields//field_options/. Path parameters: field_id, field_option_id. Wrap the option in a field_option object. PagerDuty's own sample sends the new value alone: {"field_option": {"data": {"data_type": "string", "value": "prod"}}}. Its schema additionally marks id, type, created_at and updated_at required, so if a bare data body is refused, round-trip the object pd_list_incident_custom_field_options returned and change only data.value. Returns raw PagerDuty JSON.