---
title: Alert notification payloads
summary: null
url: >-
  https://www.fastly.com/documentation/guides/observability/alerts/alert-notification-payloads
---

When an observability metrics alert fires or resolves, or when an audit log event matches an audit log alert's conditions, Fastly sends a structured notification payload to your configured integrations. This reference describes the payload format for each integration type, with examples for common scenarios.

## Observability alert payloads

### Datadog

Datadog notifications use the Datadog Events API format. The payload varies based on whether the notification is for a firing observability alert, a resolved observability alert, or an audit log alert event.

```json
{
  "title": "Title with prefix indicating notification type",
  "text": "Notification body with details and a link to view in Fastly",
  "priority": "normal",
  "tags": ["Tag values describing the notification"],
  "alert_type": "error | success | info",
  "source_type_name": "Fastly",
  "aggregation_key": "Alert definition ID (observability alerts only)"
}
```

For example, this is a Datadog notification that was sent when the origin bandwidth exceeded 100Mbps:

```json
{
  "title": "[FIRING] all_bandwidth high on critical origins",
  "text": "Triggers when origin bandwidth exceeds 100Mbps\n\nValue: 125Mbps\nThreshold: 750000000\nEvaluation period: 5m\n\nView graph: https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m",
  "priority": "normal",
  "tags": ["fastly:alerts", "alert_type:origins", "metric:all_bandwidth", "service_id:svc_M4nP7qR2sT9vW3xY8zA"],
  "alert_type": "error",
  "source_type_name": "Fastly",
  "aggregation_key": "def_XyZ9kL3mN8pQ2vR7wB4tJ"
}
```

When that same alert resolves:

```json
{
  "title": "[RESOLVED] all_bandwidth high on critical origins",
  "text": "Triggers when origin bandwidth exceeds 100Mbps\n\nValue: 95Mbps\nThreshold: 750000000\nEvaluation period: 5m\n\nView graph: https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m",
  "priority": "normal",
  "tags": ["fastly:alerts", "alert_type:origins", "metric:all_bandwidth", "service_id:svc_M4nP7qR2sT9vW3xY8zA"],
  "alert_type": "success",
  "source_type_name": "Fastly",
  "aggregation_key": "def_XyZ9kL3mN8pQ2vR7wB4tJ"
}
```

For an audit log alert event:

```json
{
  "title": "Fastly audit event: user.login",
  "text": "User logged in\n\nResource: svc_M4nP7qR2sT9vW3xY8zA",
  "priority": "normal",
  "tags": ["fastly:audit_event", "event_type:user.login"],
  "alert_type": "info",
  "source_type_name": "Fastly"
}
```

### New Relic

New Relic notifications use the New Relic Events API format with `NrAiIncidentExternal` event type.

```json
[
  {
    "eventType": "NrAiIncidentExternal",
    "title": "Alert title",
    "description": "Alert description",
    "aggregationTag.definitionId": "Alert definition ID",
    "alertHistoryId": "History ID",
    "serviceId": "Service ID (optional)",
    "state": "trigger | resolve",
    "source": "Fastly Alerts Notification Service",
    "sources": "Comma-separated sources (optional)",
    "entity.guid": "Entity GUID",
    "entityName": "Entity name",
    "type": "Alert type",
    "metric": "Metric name",
    "evaluation_type": "Evaluation strategy",
    "threshold": "Threshold value",
    "evaluation_period": "Evaluation period",
    "start": "Start timestamp",
    "end": "End timestamp (only on resolve)"
  }
]
```

For example, this is a New Relic notification that was sent when the origin bandwidth exceeded 100Mbps:

```json
[
  {
    "eventType": "NrAiIncidentExternal",
    "title": "[FIRING] all_bandwidth high on critical origins",
    "description": "Triggers when origin bandwidth exceeds 100Mbps",
    "aggregationTag.definitionId": "def_XyZ9kL3mN8pQ2vR7wB4tJ",
    "alertHistoryId": "hist_A7bC2dE9fG3hJ8kL5m",
    "serviceId": "svc_M4nP7qR2sT9vW3xY8zA",
    "state": "trigger",
    "source": "Fastly Alerts Notification Service",
    "sources": "origin1, origin3",
    "entity.guid": "def_XyZ9kL3mN8pQ2vR7wB4tJ",
    "entityName": "High Origin Bandwidth Alert",
    "type": "origins",
    "metric": "all_bandwidth",
    "evaluation_type": "above_threshold",
    "threshold": "750000000",
    "evaluation_period": "5m",
    "start": "2026-02-27T10:30:00Z"
  }
]
```

## Incident response and on-call alert payloads

### Jira Service Management

Jira Service Management notifications use the JSM operations Alert API, which shares its structure with the Opsgenie Alert API.

```json
{
  "message": "Title with prefix indicating notification type",
  "alias": "Typed identifier that links related events together",
  "description": "Alert description or audit event message",
  "source": "Fastly Alerts Notification Service",
  "tags": ["Tag values describing the alert"],
  "details": {
    "Key": "Value pairs of alert metadata"
  }
}
```

For example, this is a Jira Service Management notification that was sent when the origin bandwidth exceeded 100Mbps:

```json
{
  "message": "[FIRING] all_bandwidth high on critical origins",
  "alias": "fastly-alerts-def_XyZ9kL3mN8pQ2vR7wB4tJ",
  "description": "Triggers when origin bandwidth exceeds 100Mbps",
  "source": "Fastly Alerts Notification Service",
  "tags": ["fastly:alerts", "metric:all_bandwidth"],
  "details": {
    "FastlyAlertMetric": "all_bandwidth",
    "FastlyAlertThreshold": "750000000",
    "FastlyAlertPeriod": "5m",
    "FastlyAlertValue": "125Mbps",
    "FastlyServiceID": "svc_M4nP7qR2sT9vW3xY8zA",
    "FastlyHistoryURL": "https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m"
  }
}
```

### Opsgenie

> **WARNING:** On March 4, 2025 Atlassian announced that Opsgenie would no longer be available for purchase, effective June 4, 2025. Existing customers are able to continue using Opsgenie, without interruption, until the end of support on April 5, 2027. Opsgenie customers have until this date to move their data and configurations to Jira Service Management, which Fastly provides an alert integration for. For more information about Atlassian's end-of-life announcement and what to do about it, read their guidance on [managing your Opsgenie account](https://www.atlassian.com/licensing/opsgenie#managing-my-opsgenie-account).

Opsgenie notifications use the Opsgenie Alert API.

```json
{
  "message": "Title with prefix indicating notification type",
  "alias": "Typed identifier that links related events together",
  "description": "Alert description or audit event message",
  "source": "Fastly Alerts Notification Service",
  "tags": ["Tag values describing the alert"],
  "details": {
    "Key": "Value pairs of alert metadata"
  }
}
```

For example, this is an Opsgenie notification that was sent when the origin bandwidth exceeded 100Mbps:

```json
{
  "message": "[FIRING] all_bandwidth high on critical origins",
  "alias": "fastly-alerts-def_XyZ9kL3mN8pQ2vR7wB4tJ",
  "description": "Triggers when origin bandwidth exceeds 100Mbps",
  "source": "Fastly Alerts Notification Service",
  "tags": ["fastly:alerts", "metric:all_bandwidth"],
  "details": {
    "FastlyAlertMetric": "all_bandwidth",
    "FastlyAlertThreshold": "750000000",
    "FastlyAlertPeriod": "5m",
    "FastlyAlertValue": "125Mbps",
    "FastlyServiceID": "svc_M4nP7qR2sT9vW3xY8zA",
    "FastlyHistoryURL": "https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m"
  }
}
```

### PagerDuty

PagerDuty notifications use the PagerDuty Events API v2 format.

```json
{
  "payload": {
    "summary": "Alert summary",
    "severity": "critical",
    "source": "Source URL",
    "timestamp": "ISO 8601 timestamp",
    "custom_details": {
      "key": "value"
    }
  },
  "dedup_key": "Unique identifier for alert",
  "links": [
    {
      "href": "URL",
      "text": "Link text"
    }
  ],
  "client": "Fastly Alerts Notification Service",
  "event_action": "trigger | resolve"
}
```

For example, this is a PagerDuty notification that was sent when the origin bandwidth exceeded 100Mbps:

```json
{
  "payload": {
    "summary": "[FIRING] all_bandwidth high on critical origins",
    "severity": "critical",
    "source": "https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m",
    "timestamp": "2026-02-27T10:30:00Z",
    "custom_details": {
      "name": "High Origin Bandwidth Alert",
      "description": "Triggers when origin bandwidth exceeds 100Mbps",
      "metric": "all_bandwidth",
      "service": "svc_M4nP7qR2sT9vW3xY8zA",
      "type": "origins",
      "sources": "origin1, origin3",
      "evaluation_type": "above_threshold",
      "threshold": "750000000",
      "evaluation_period": "5m",
      "value": "125Mbps"
    }
  },
  "dedup_key": "def_XyZ9kL3mN8pQ2vR7wB4tJ",
  "links": [
    {
      "href": "https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m",
      "text": "https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m"
    }
  ],
  "client": "Fastly Alerts Notification Service",
  "event_action": "trigger"
}
```

### Splunk On-Call

Splunk On-Call notifications use the REST endpoint integration format. The payload varies based on whether the notification is for a firing observability alert, a resolved observability alert, or an audit log alert event.

```json
{
  "message_type": "CRITICAL | RECOVERY | INFO",
  "entity_id": "Typed identifier that links related events together",
  "entity_display_name": "Title with prefix indicating notification type",
  "state_message": "Alert description or event message",
  "monitoring_tool": "Fastly"
}
```

For example, this is a Splunk On-Call notification that was sent when the origin bandwidth exceeded 100Mbps:

```json
{
  "message_type": "CRITICAL",
  "entity_id": "fastly-alerts-def_XyZ9kL3mN8pQ2vR7wB4tJ",
  "entity_display_name": "[FIRING] all_bandwidth high on critical origins",
  "state_message": "Triggers when origin bandwidth exceeds 100Mbps",
  "monitoring_tool": "Fastly",
  "FastlyAlertMetric": "all_bandwidth",
  "FastlyAlertThreshold": "750000000",
  "FastlyAlertPeriod": "5m",
  "FastlyAlertValue": "125Mbps",
  "FastlyServiceID": "svc_M4nP7qR2sT9vW3xY8zA",
  "FastlyHistoryURL": "https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m"
}
```

When that same alert resolves:

```json
{
  "message_type": "RECOVERY",
  "entity_id": "fastly-alerts-def_XyZ9kL3mN8pQ2vR7wB4tJ",
  "entity_display_name": "[RESOLVED] all_bandwidth high on critical origins",
  "state_message": "Triggers when origin bandwidth exceeds 100Mbps",
  "monitoring_tool": "Fastly",
  "FastlyAlertMetric": "all_bandwidth",
  "FastlyAlertThreshold": "750000000",
  "FastlyAlertPeriod": "5m",
  "FastlyAlertValue": "95Mbps",
  "FastlyServiceID": "svc_M4nP7qR2sT9vW3xY8zA",
  "FastlyHistoryURL": "https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m"
}
```

For an audit log alert event:

```json
{
  "message_type": "INFO",
  "entity_id": "fastly-audit-event-user.login",
  "entity_display_name": "Fastly audit event: user.login",
  "state_message": "User logged in",
  "monitoring_tool": "Fastly",
  "FastlyAuditScopeID": "svc_M4nP7qR2sT9vW3xY8zA"
}
```

## Team communication alert payloads

### Email

Email notifications deliver alert information in both HTML and plain text formats with a descriptive subject line.

```json
{
  "subject": "Fastly Alert: {alert_name} {Firing|Resolved}",
  "plainBody": "Alert details...",
  "htmlBody": "<html>Formatted alert details...</html>"
}
```

For example, this is an email notification that was sent when the origin bandwidth exceeded 100Mbps:

```json
{
  "subject": "Fastly Alert: High Origin Bandwidth Alert Firing",
  "plainBody": "[FIRING] all_bandwidth high on critical origins\n\nValue: 125Mbps\n\nStarted (UTC): 2026-02-27T10:30:00Z\n\nDetails:\n- name: High Origin Bandwidth Alert\n- description: Triggers when origin bandwidth exceeds 100Mbps\n- metric: all_bandwidth\n- service: svc_M4nP7qR2sT9vW3xY8zA\n- evaluation type: above_threshold\n- threshold: 750000000\n- evaluation period: 5m\n- sources: origin1, origin3\n\nView in Fastly: https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m",
  "htmlBody": "<html><body><h2>[FIRING] all_bandwidth high on critical origins</h2><p><strong>Value:</strong> 125Mbps</p><p><strong>Started (UTC):</strong> 2026-02-27T10:30:00Z</p><h3>Details</h3><ul><li><strong>name:</strong> High Origin Bandwidth Alert</li><li><strong>description:</strong> Triggers when origin bandwidth exceeds 100Mbps</li><li><strong>metric:</strong> all_bandwidth</li><li><strong>service:</strong> svc_M4nP7qR2sT9vW3xY8zA</li><li><strong>evaluation type:</strong> above_threshold</li><li><strong>threshold:</strong> 750000000</li><li><strong>evaluation period:</strong> 5m</li><li><strong>sources:</strong> origin1, origin3</li></ul><p><a href=\"https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m\">View in Fastly</a></p></body></html>"
}
```

### Jira Issue

Jira Issue notifications use the Jira create issue API. Each notification creates a new issue in the project and issue type configured on the integration.

```json
{
  "fields": {
    "project": {
      "key": "Project key configured on the integration"
    },
    "issuetype": {
      "name": "Issue type configured on the integration"
    },
    "summary": "Title with prefix indicating notification type",
    "description": "Notification body with alert details and a link to view in Fastly"
  }
}
```

For example, this is a Jira issue that was created when the origin bandwidth exceeded 100Mbps:

```json
{
  "fields": {
    "project": {
      "key": "OPS"
    },
    "issuetype": {
      "name": "Task"
    },
    "summary": "[FIRING] all_bandwidth high on critical origins",
    "description": "Triggers when origin bandwidth exceeds 100Mbps\n\nFastlyAlertMetric: all_bandwidth\nFastlyAlertThreshold: 750000000\nFastlyAlertPeriod: 5m\nFastlyAlertValue: 125Mbps\nFastlyServiceID: svc_M4nP7qR2sT9vW3xY8zA\nFastlyHistoryURL: https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m"
  }
}
```

### Microsoft Teams

Microsoft Teams notifications use Adaptive Cards for rich, interactive notifications.

```json
{
  "type": "message",
  "attachments": [
    {
      "contentType": "application/vnd.microsoft.card.adaptive",
      "content": {
        "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
        "type": "AdaptiveCard",
        "version": "1.4",
        "body": [
          {
            "type": "Container",
            "items": [...]
          }
        ],
        "actions": [
          {
            "type": "Action.OpenUrl",
            "title": "View",
            "url": "..."
          }
        ]
      }
    }
  ]
}
```

For example, this is a Microsoft Teams notification that was sent when the origin bandwidth exceeded 100Mbps:

```json
{
  "type": "message",
  "attachments": [
    {
      "contentType": "application/vnd.microsoft.card.adaptive",
      "content": {
        "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
        "type": "AdaptiveCard",
        "version": "1.4",
        "body": [
          {
            "type": "Container",
            "items": [
              {
                "type": "TextBlock",
                "text": "[FIRING] all_bandwidth high on critical origins",
                "weight": "Bolder",
                "size": "Medium",
                "wrap": true
              },
              {
                "type": "TextBlock",
                "text": "125Mbps"
              },
              {
                "type": "FactSet",
                "facts": [
                  {
                    "title": "Started (UTC):",
                    "value": "2026-02-27T10:30:00Z"
                  }
                ]
              }
            ]
          },
          {
            "type": "Container",
            "items": [
              {
                "type": "FactSet",
                "facts": [
                  {
                    "title": "Name:",
                    "value": "High Origin Bandwidth Alert"
                  },
                  {
                    "title": "Description:",
                    "value": "Triggers when origin bandwidth exceeds 100Mbps"
                  },
                  {
                    "title": "Metric:",
                    "value": "all_bandwidth"
                  },
                  {
                    "title": "Service ID:",
                    "value": "svc_M4nP7qR2sT9vW3xY8zA"
                  },
                  {
                    "title": "Sources:",
                    "value": "origin1, origin3"
                  },
                  {
                    "title": "Evaluation Type:",
                    "value": "above_threshold"
                  },
                  {
                    "title": "Threshold:",
                    "value": "750000000"
                  },
                  {
                    "title": "Evaluation Period:",
                    "value": "5m"
                  }
                ]
              }
            ]
          }
        ],
        "actions": [
          {
            "type": "Action.OpenUrl",
            "title": "View",
            "url": "https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m"
          }
        ]
      }
    }
  ]
}
```

### Slack

Slack notifications use the Slack API attachment format with color-coded messages: red for firing alerts and green for resolved alerts.

```json
{
  "username": "Fastly Alerts",
  "icon_url": "https://manage.fastly.com/observe/logo.png",
  "attachments": [
    {
      "color": "#dd2530 | #36a64f",
      "title": "Alert title with link",
      "title_link": "URL to alert history",
      "mrkdwn_in": ["Details"],
      "fields": [
        {"title": "Field name", "value": "Field value", "short": false}
      ]
    }
  ]
}
```

For example, this is a Slack notification that was sent when the origin bandwidth exceeded 100Mbps:

```json
{
  "username": "Fastly Alerts",
  "icon_url": "https://manage.fastly.com/observe/logo.png",
  "attachments": [
    {
      "color": "#dd2530",
      "title": "[FIRING] all_bandwidth high on critical origins",
      "title_link": "https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m",
      "mrkdwn_in": ["Details"],
      "fields": [
        {
          "title": "High Origin Bandwidth Alert",
          "value": "125Mbps",
          "short": false
        },
        {
          "title": "Started (UTC)",
          "value": "2026-02-27T10:30:00Z",
          "short": false
        },
        {
          "title": "Details",
          "value": "- *name:* High Origin Bandwidth Alert\n- *description:* Triggers when origin bandwidth exceeds 100Mbps\n- *metric:* all_bandwidth\n- *service:* svc_M4nP7qR2sT9vW3xY8zA\n- *evaluation type:* above_threshold\n- *threshold:* 750000000\n- *evaluation period:* 5m\n- *sources:* origin1, origin3",
          "short": false
        }
      ]
    }
  ]
}
```

## Custom webhook alert payloads

When an alert fires or resolves, Fastly sends a POST request to your configured webhook endpoint with the following JSON payload:

```json
{
  "title": "Alert title with status",
  "description": "Alert description",
  "history_api": "API endpoint URL for alert history",
  "history_ui": "Fastly control panel URL for alert history",
  "definition_api": "API endpoint URL for alert definition",
  "definition_ui": "Fastly control panel URL for alert definition",
  "triggered": true | false,
  "start": "ISO 8601 timestamp",
  "end": "ISO 8601 timestamp (only when triggered is false)",
  "version": "v1"
}
```

For example, this is a webhook notification that was sent when the bandwidth exceeded 100Mbps:

```json
{
  "title": "[FIRING] bandwidth high on critical stats",
  "description": "Triggers when bandwidth exceeds 100Mbps",
  "history_api": "https://api.fastly.com/alerts/history?definition_id=def_xyz789&after=2026-02-27T10:30:00Z&before=2026-02-27T10:30:00Z",
  "history_ui": "https://manage.fastly.com/observability/alerts/history/def_xyz789?id=hist_abc123",
  "definition_api": "https://api.fastly.com/alerts/definitions/def_xyz789",
  "definition_ui": "https://manage.fastly.com/observability/alerts/definitions/def_xyz789/edit",
  "triggered": true,
  "start": "2026-02-27T10:30:00Z",
  "version": "v1"
}
```