1. Home
  2. Guides
  3. Observability
  4. Alerts

Alert notification payloads

When an observability metrics alert fires or resolves, or when an audit log event matches an audit log alert's conditions, Fastly sends a structured notification payload to your configured integrations. This reference describes the payload format for each integration type, with examples for common scenarios.

Observability alert payloads

  1. Datadog
  2. New Relic

Datadog notifications use the Datadog Events API format. The payload varies based on whether the notification is for a firing observability alert, a resolved observability alert, or an audit log alert event.

1
2
3
4
5
6
7
8
9
{
  "title": "Title with prefix indicating notification type",
  "text": "Notification body with details and a link to view in Fastly",
  "priority": "normal",
  "tags": ["Tag values describing the notification"],
  "alert_type": "error | success | info",
  "source_type_name": "Fastly",
  "aggregation_key": "Alert definition ID (observability alerts only)"
}

For example, this is a Datadog notification that was sent when the origin bandwidth exceeded 100Mbps:

1
2
3
4
5
6
7
8
9
{
  "title": "[FIRING] all_bandwidth high on critical origins",
  "text": "Triggers when origin bandwidth exceeds 100Mbps\n\nValue: 125Mbps\nThreshold: 750000000\nEvaluation period: 5m\n\nView graph: https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m",
  "priority": "normal",
  "tags": ["fastly:alerts", "alert_type:origins", "metric:all_bandwidth", "service_id:svc_M4nP7qR2sT9vW3xY8zA"],
  "alert_type": "error",
  "source_type_name": "Fastly",
  "aggregation_key": "def_XyZ9kL3mN8pQ2vR7wB4tJ"
}

When that same alert resolves:

1
2
3
4
5
6
7
8
9
{
  "title": "[RESOLVED] all_bandwidth high on critical origins",
  "text": "Triggers when origin bandwidth exceeds 100Mbps\n\nValue: 95Mbps\nThreshold: 750000000\nEvaluation period: 5m\n\nView graph: https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m",
  "priority": "normal",
  "tags": ["fastly:alerts", "alert_type:origins", "metric:all_bandwidth", "service_id:svc_M4nP7qR2sT9vW3xY8zA"],
  "alert_type": "success",
  "source_type_name": "Fastly",
  "aggregation_key": "def_XyZ9kL3mN8pQ2vR7wB4tJ"
}

For an audit log alert event:

1
2
3
4
5
6
7
8
{
  "title": "Fastly audit event: user.login",
  "text": "User logged in\n\nResource: svc_M4nP7qR2sT9vW3xY8zA",
  "priority": "normal",
  "tags": ["fastly:audit_event", "event_type:user.login"],
  "alert_type": "info",
  "source_type_name": "Fastly"
}

Incident response and on-call alert payloads

  1. Jira Service Management
  2. Opsgenie
  3. PagerDuty
  4. Splunk On-Call

Jira Service Management notifications use the JSM operations Alert API, which shares its structure with the Opsgenie Alert API.

1
2
3
4
5
6
7
8
9
10
{
  "message": "Title with prefix indicating notification type",
  "alias": "Typed identifier that links related events together",
  "description": "Alert description or audit event message",
  "source": "Fastly Alerts Notification Service",
  "tags": ["Tag values describing the alert"],
  "details": {
    "Key": "Value pairs of alert metadata"
  }
}

For example, this is a Jira Service Management notification that was sent when the origin bandwidth exceeded 100Mbps:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
{
  "message": "[FIRING] all_bandwidth high on critical origins",
  "alias": "fastly-alerts-def_XyZ9kL3mN8pQ2vR7wB4tJ",
  "description": "Triggers when origin bandwidth exceeds 100Mbps",
  "source": "Fastly Alerts Notification Service",
  "tags": ["fastly:alerts", "metric:all_bandwidth"],
  "details": {
    "FastlyAlertMetric": "all_bandwidth",
    "FastlyAlertThreshold": "750000000",
    "FastlyAlertPeriod": "5m",
    "FastlyAlertValue": "125Mbps",
    "FastlyServiceID": "svc_M4nP7qR2sT9vW3xY8zA",
    "FastlyHistoryURL": "https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m"
  }
}

Team communication alert payloads

  1. Email
  2. Jira Issue
  3. Microsoft Teams
  4. Slack

Email notifications deliver alert information in both HTML and plain text formats with a descriptive subject line.

{
  "subject": "Fastly Alert: {alert_name} {Firing|Resolved}",
  "plainBody": "Alert details...",
  "htmlBody": "<html>Formatted alert details...</html>"
}

For example, this is an email notification that was sent when the origin bandwidth exceeded 100Mbps:

{
  "subject": "Fastly Alert: High Origin Bandwidth Alert Firing",
  "plainBody": "[FIRING] all_bandwidth high on critical origins\n\nValue: 125Mbps\n\nStarted (UTC): 2026-02-27T10:30:00Z\n\nDetails:\n- name: High Origin Bandwidth Alert\n- description: Triggers when origin bandwidth exceeds 100Mbps\n- metric: all_bandwidth\n- service: svc_M4nP7qR2sT9vW3xY8zA\n- evaluation type: above_threshold\n- threshold: 750000000\n- evaluation period: 5m\n- sources: origin1, origin3\n\nView in Fastly: https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m",
  "htmlBody": "<html><body><h2>[FIRING] all_bandwidth high on critical origins</h2><p><strong>Value:</strong> 125Mbps</p><p><strong>Started (UTC):</strong> 2026-02-27T10:30:00Z</p><h3>Details</h3><ul><li><strong>name:</strong> High Origin Bandwidth Alert</li><li><strong>description:</strong> Triggers when origin bandwidth exceeds 100Mbps</li><li><strong>metric:</strong> all_bandwidth</li><li><strong>service:</strong> svc_M4nP7qR2sT9vW3xY8zA</li><li><strong>evaluation type:</strong> above_threshold</li><li><strong>threshold:</strong> 750000000</li><li><strong>evaluation period:</strong> 5m</li><li><strong>sources:</strong> origin1, origin3</li></ul><p><a href=\"https://manage.fastly.com/observability/alerts/history/def_XyZ9kL3mN8pQ2vR7wB4tJ?id=hist_A7bC2dE9fG3hJ8kL5m\">View in Fastly</a></p></body></html>"
}

Custom webhook alert payloads

When an alert fires or resolves, Fastly sends a POST request to your configured webhook endpoint with the following JSON payload:

1
2
3
4
5
6
7
8
9
10
11
12
{
  "title": "Alert title with status",
  "description": "Alert description",
  "history_api": "API endpoint URL for alert history",
  "history_ui": "Fastly control panel URL for alert history",
  "definition_api": "API endpoint URL for alert definition",
  "definition_ui": "Fastly control panel URL for alert definition",
  "triggered": true | false,
  "start": "ISO 8601 timestamp",
  "end": "ISO 8601 timestamp (only when triggered is false)",
  "version": "v1"
}

For example, this is a webhook notification that was sent when the bandwidth exceeded 100Mbps:

1
2
3
4
5
6
7
8
9
10
11
{
  "title": "[FIRING] bandwidth high on critical stats",
  "description": "Triggers when bandwidth exceeds 100Mbps",
  "history_api": "https://api.fastly.com/alerts/history?definition_id=def_xyz789&after=2026-02-27T10:30:00Z&before=2026-02-27T10:30:00Z",
  "history_ui": "https://manage.fastly.com/observability/alerts/history/def_xyz789?id=hist_abc123",
  "definition_api": "https://api.fastly.com/alerts/definitions/def_xyz789",
  "definition_ui": "https://manage.fastly.com/observability/alerts/definitions/def_xyz789/edit",
  "triggered": true,
  "start": "2026-02-27T10:30:00Z",
  "version": "v1"
}
Fastly
© Fastly 2026