How StackOne sets up PagerDuty webhooks

Nothing needs configuring in PagerDuty. When you connect an account with events enabled, StackOne creates a v3 webhook subscription automatically and deletes it again when the connection is removed. A single subscription carries every event you enable.

Webhook subscriptions are created with the same API key the connection uses. A read-only key can list incidents but cannot create the subscription, so the connection is established and no events are ever delivered.

Use a key with write access when connecting the account.

StackOne scopes the subscription to the whole account, so it reports on every service and every team. PagerDuty also supports narrowing a subscription to one service or one team, but those variants only report on objects associated with that one service or team.

An account-wide subscription means a new service needs no extra setup to be covered.

The subscription StackOne creates is described as StackOne and is listed among the account's webhook subscriptions. Leave it alone — StackOne manages its whole lifecycle and deletes it when the connection is removed.

PagerDuty rejects a subscription outright if any single event in it is unsupported, so an enabled event that an account's plan does not offer will stop the whole subscription from being created.

Available webhook events

PagerDuty emits thirty-one event types across incidents and services. Only events selected in StackOne are included in the subscription — PagerDuty sends nothing for events that are not subscribed.

Events covering an incident being raised, worked and closed.

Incident Triggered (`incident.triggered`) — Fired when an incident is newly created.
Incident Acknowledged (`incident.acknowledged`) — Fired when an incident is acknowledged.
Incident Unacknowledged (`incident.unacknowledged`) — Fired when an incident returns to triggered, for example when an acknowledgement times out.
Incident Escalated (`incident.escalated`) — Fired when an incident is escalated to another user in the same escalation level.
Incident Reassigned (`incident.reassigned`) — Fired when an incident is reassigned to another user.
Incident Delegated (`incident.delegated`) — Fired when an incident is moved to another escalation policy.
Incident Resolved (`incident.resolved`) — Fired when an incident is resolved.
Incident Reopened (`incident.reopened`) — Fired when a resolved incident is reopened.

Events covering changes to an incident's own fields and the information attached to it.

Incident Priority Updated (`incident.priority_updated`) — Fired when an incident's priority changes.
Incident Service Updated (`incident.service_updated`) — Fired when an incident is moved to another service.
Incident Type Updated (`incident.incident_type.updated`) — Fired when an incident's type is changed.
Incident Custom Field Values Updated (`incident.custom_field_values.updated`) — Fired when an incident's custom field values change.
Incident Annotated (`incident.annotated`) — Fired when a note is added to an incident.
Incident Status Update Published (`incident.status_update_published`) — Fired when a status update is published on an incident.
Incident Conference Bridge Updated (`incident.conference_bridge.updated`) — Fired when an incident's conference bridge number or URL changes.
Scribe Summary Created (`scribe.summary.created`) — Fired when PagerDuty Scribe creates a summary.

Events covering the people pulled into an incident.

Incident Responder Added (`incident.responder.added`) — Fired when a responder is added to an incident.
Incident Responder Replied (`incident.responder.replied`) — Fired when a responder accepts or declines a response request.
Incident Role Assigned (`incident.role.assigned`) — Fired when an incident role is assigned or unassigned.

Events covering the task list on an incident.

Incident Task Created (`incident.task.created`) — Fired when a task is added to an incident.
Incident Task Updated (`incident.task.updated`) — Fired when an incident task changes.
Incident Task Completed (`incident.task.completed`) — Fired when an incident task is completed.

Events covering automation actions and incident workflows running against an incident.

Incident Action Invocation Created (`incident.action_invocation.created`) — Fired when an automation action is invoked on an incident.
Incident Action Invocation Updated (`incident.action_invocation.updated`) — Fired when an action invocation changes.
Incident Action Invocation Terminated (`incident.action_invocation.terminated`) — Fired when an action invocation is terminated.
Incident Workflow Started (`incident.workflow.started`) — Fired when an incident workflow starts.
Incident Workflow Completed (`incident.workflow.completed`) — Fired when an incident workflow completes.

Events covering the services on the account.

Service Created (`service.created`) — Fired when a service is created.
Service Updated (`service.updated`) — Fired when a service is updated.
Service Deleted (`service.deleted`) — Fired when a service is deleted.
Service Custom Field Values Updated (`service.custom_field_values.updated`) — Fired when a service's custom field values change.

Several events depend on PagerDuty features that not every plan includes — incident tasks, incident roles, custom fields, conference bridges, automation actions, incident workflows and Scribe summaries among them. Enable the events your account actually offers, because one unsupported event stops the whole subscription from being created.

A notification identifies what changed rather than carrying the full record. Incident events report the incident as the record, including events about a note, a responder or a status update, so read the incident with Get Incident when you need its contents. Service events report the service.

Treat each notification as a signal to re-read the record rather than as a change log.