Skip to main content
Manage → Integrations is where you connect the places aiAxonIQ sends notifications. Each connection is a notification channel: a named destination with its credential, which escalation policies page. A destination outlives any one rule, so it is managed here rather than inside Alerts.
Anyone in the organization can see which connections exist. Connecting, editing, testing and removing them requires the Admin role or higher. A test sends a real message to a real channel, which is why it sits with Admin. Non-admins see the connection names and types, and Details are admin-only in place of the rest. See Roles and permissions.

​
What you can connect

The Integrations page lists exactly five integrations. These are the only channel types aiAxonIQ creates:
The icons elsewhere in the product are not integrations. aiAxonIQ recognises many technologies in your telemetry and shows their logos. Only the five above can be connected as a notification destination. Pulling data out of aiAxonIQ into Grafana or another Prometheus client is a different mechanism — see Grafana and Prometheus clients.
A webhook URL must not contain a username or password, and any other host is refused. That is a security control, not a formatting rule: a destination URL you choose is a request the platform makes on your behalf, and a genuine Slack or Teams webhook is never anywhere else.

​
Generic outbound webhooks are off

A generic webhook channel cannot be created. Outbound webhooks to an arbitrary URL are turned off by default, pending server-side request-forgery protection, request signing and retry handling, and the Integrations page does not offer one.If your organization already has webhook channels from before this page existed, the page counts them under Not shown here. They cannot be edited here, and they do not deliver unless your operator has turned webhook delivery on for the whole deployment — a test of one reports webhook_delivery_disabled.

​
How credentials are stored

Channel credentials are bearer secrets: whoever holds a Slack webhook URL or a PagerDuty key can post as you. aiAxonIQ treats them that way.
  • Sealed before storage. A credential is sealed with AES-GCM under a server-held key before it is written, and decrypted only at the moment a notification or test is sent. Keys can be rotated without downtime for your channels.
  • Never sent back to you. The list of connections returns only each one’s name and type, to every role. Admins additionally see a short, non-reversible summary — whether a webhook is set, a recipient count, the last four characters of a key — never the credential itself.
  • Not recoverable. Once saved, a credential cannot be revealed. To change one, enter the new value; to move a connection elsewhere, remove it and add it again.
  • Audited. Creating, editing, testing and removing a connection are recorded in the Audit log, with who did it and whether a test succeeded.
On a self-hosted deployment, channels created before credential sealing was introduced remain readable in their original form until your operator re-seals them with the rotation procedure. Every channel created or edited since is sealed.

​
Connect a channel

1

Get the credential from the provider

Create the incoming webhook (Slack, Teams), the Events API v2 integration (PagerDuty) or the API integration (Opsgenie) in that product first. For Email, decide the recipient list.
2

Open Integrations

Go to Manage → Integrations and choose the integration.
3

Fill in the dialog

Give the connection a Name. It is how the connection is shown in escalation policies — two Slack channels are told apart by this and nothing else — so name it after its destination, for example #payments-oncall. Then enter the credential.
4

Test before saving

Press Test connection. A [TEST] message is delivered with what you typed, and nothing is saved yet.
5

Connect

Press Connect. The connection appears on the integration’s page, ready to be chosen by an escalation policy.

​
Where connections are used

  • Escalation policies page connections level by level. See Escalation policies.
  • SLO error-budget policies can record a connection alongside their thresholds. Recording it does not by itself send anything: no notification is delivered to that connection when a threshold is crossed. See Service level objectives.
The alert rule form configures its channel directly. When you create a rule under Alerts, you pick a channel type and enter its configuration on the rule itself, rather than choosing one of these connections. See the channel settings in Alerting.

​
Testing a saved connection

Every saved connection has Send test. It sends a [TEST] message and tells you whether the provider accepted it and how long that took.
  • A successful test means the provider accepted the message. Check the destination too — a provider can accept a message and still drop it.
  • Tests use a separate deduplication key in PagerDuty and Opsgenie, so a test never merges with, or resolves, a real incident.
  • Tests are not withheld by maintenance windows.
If the stored configuration cannot produce a delivery at all — a missing key, for example — the connection shows This connection cannot deliver. That warning is the only health signal the page has: the absence of a warning is not a guarantee that the next message will arrive.

​
Delivery behaviour

Notifications are recorded before they are attempted, then delivered independently per channel — a Slack outage does not affect the PagerDuty page for the same alert.
  • Slack, Teams, PagerDuty and Opsgenie requests time out after 10 seconds and are attempted up to four times in quick succession (waits of 1, 5 and 30 seconds). A 4xx answer is not retried: a rejected payload will be rejected again.
  • A delivery that still fails with a temporary error — including an email the mail server did not accept — is retried later, up to six attempts in total over roughly half an hour, then marked failed. Retrying longer would deliver an alert about something long resolved.
  • By default each channel accepts at most 60 notifications per minute per organization. Beyond that, notifications are withheld rather than queued; CRITICAL notifications are exempt.

​
Removing a connection

Remove deletes the connection and its credential. It cannot be recovered. Any SLO error-budget policy that recorded it is detached automatically, and the response says how many.
Check escalation policies before you remove a connection. A policy level that still names a removed connection fails as a whole — none of the level’s channels is notified, not just the removed one. Edit every level that names a connection before removing it. See Escalation policies.

​
Security considerations

  • Keep connecting and testing with Admins. A test is a real message, and a lower bar would let anyone post into your incident channels.
  • Treat a webhook URL as a password: rotate it at the provider if it has been shared, then edit the connection with the new URL.
  • Prefer a dedicated PagerDuty service integration and an Opsgenie API integration for aiAxonIQ, so you can revoke aiAxonIQ’s access at the provider without affecting anything else.
  • Email recipients receive whatever the alert contains, including the rule name and runbook link; use team distribution lists rather than personal addresses.

​
Verify it works

1

Send a test

On the connection, press Send test. Expect Test delivered with a latency in milliseconds, and a [TEST] message at the destination.
2

Check the audit log

An integration channel tested entry appears in the Audit log with the outcome.
3

Exercise it for real

Put the connection on a one-level escalation policy and let an incident go unacknowledged — see Escalation policies.

​
Troubleshooting

The URL is not on the provider’s own webhook host. Copy the webhook URL exactly as Slack or Teams issued it. Custom domains and proxies are refused.
Use the https URL the provider issued, without a user:password@ part.
The provider rejected the credential or the payload. Regenerate the webhook or key at the provider and edit the connection. 4xx answers are not retried.
Email delivery depends on a mail transport configured for your deployment. On a self-hosted deployment your operator must configure one; until then, use another channel. Do not rely on email as your only channel either way.
Managing integrations requires the Admin role. Ask an Admin or Owner.
Connections created before this page existed may be stored in a form it cannot edit. Remove the connection and add it again — and update any escalation policy levels that named it.
Not available: generic outbound webhooks are off by default. Use Slack, Teams, PagerDuty, Opsgenie or Email.

​
Next

Escalation policies

Page connections when nobody acknowledges.

Alerting

Rules, conditions and the Test action.

Grafana and Prometheus clients

Query aiAxonIQ from Grafana.

Incidents

What notifications are about.