ROB-3785 Add Send Events API documentation with integration guides#2076
Open
naomi-robusta wants to merge 16 commits into
Open
ROB-3785 Add Send Events API documentation with integration guides#2076naomi-robusta wants to merge 16 commits into
naomi-robusta wants to merge 16 commits into
Conversation
…end Events API - Move "Send Alerts API" out of HTTP APIs and into "Robusta Classic / Send Alerts to Robusta" as the first entry, with a card on the landing page. - Add a new "Send Events API" page documenting the unified /webhooks ingestion endpoint described in relay's 2026-05-10_webhooks design doc. - Add per-origin integration pages for AlertManager, PagerDuty, Datadog, New Relic, Dynatrace, Grafana, GCP Monitoring, Azure Monitor, Splunk, Sentry, LaunchDarkly, Argo CD, GitHub, Opsgenie, Rootly, Incident.io, Nagios, SolarWinds, and AWS CloudWatch. - Link the per-origin pages from the Send Events API page in the same grid-card layout used by Send Alerts to Robusta.
|
✅ Docker image ready for
Use this tag to pull the image for testing. 📋 Copy commandsgcloud auth configure-docker us-central1-docker.pkg.dev
docker pull us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:18444e2
docker tag us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:18444e2 me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:18444e2
docker push me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:18444e2Patch Helm values in one line: helm upgrade --install robusta robusta/robusta \
--reuse-values \
--set runner.image=me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:18444e2 |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThis PR introduces comprehensive documentation for Robusta's new "Send Events API"—a unified webhook endpoint for ingesting alerts, incidents, and changes from 14+ monitoring platforms—and replaces references to the legacy "Send Alerts API" throughout the documentation site. ChangesSend Events API Documentation
🎯 2 (Simple) | ⏱️ ~10 minutes Possibly Related PRs
Suggested Reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (2)
docs/configuration/exporting/send-events/launchdarkly.rst (1)
27-27: ⚡ Quick winAdd security warning for URL query-parameter token exposure
At line 27, appending the token as a query parameter (
&token=...) is a recognized security risk because query parameters leak via server logs, proxy logs, and browser history. Add a brief note recommending the use of scoped API keys with a rotation policy to mitigate exposure.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/configuration/exporting/send-events/launchdarkly.rst` at line 27, Update the LaunchDarkly docs line that instructs appending "&token=<ROBUSTA_API_KEY>" to the URL by adding a brief security warning: note that query-parameter tokens can be exposed in server/proxy logs and browser history, recommend using HMAC signing where supported instead, and advise using scoped API keys with limited permissions plus a rotation policy to mitigate exposure. Ensure the warning is adjacent to the existing LaunchDarkly guidance so readers see the safer alternatives and key management recommendations.docs/configuration/exporting/send-events-api.rst (1)
254-254: ⚡ Quick winAdd trailing newlines to all documentation files.
All seven RST files in this PR are missing a trailing newline at the end of the file. POSIX-compliant text files should end with a newline character, and some version control systems and text processing tools expect this.
Files affected:
send-events-api.rst(line 254)dynatrace.rst(line 39)argocd.rst(line 53)opsgenie.rst(line 38)alertmanager.rst(line 49)splunk.rst(line 40)pagerduty.rst(line 48)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/configuration/exporting/send-events-api.rst` at line 254, Add a trailing newline character at EOF for each of the seven RST files listed (send-events-api.rst, dynatrace.rst, argocd.rst, opsgenie.rst, alertmanager.rst, splunk.rst, pagerduty.rst) so they become POSIX-compliant text files; open each file (e.g., send-events-api.rst) and ensure the last line ends with a single '\n' character, save the file and commit the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/configuration/exporting/send-events/argocd.rst`:
- Line 47: Add a concrete example showing how to set the annotation key by
replacing <trigger> with a real trigger name (e.g., "on-sync-failed") and
include a complete annotation snippet for an Argo CD Application
(metadata.annotations with
notifications.argoproj.io/subscribe.on-sync-failed.robusta: "enabled" or a list
of receivers/triggers). Reference the annotation pattern
notifications.argoproj.io/subscribe.<trigger>.robusta and provide a minimal
Application metadata example so readers can copy/paste a fully-formed
annotation.
In `@docs/configuration/exporting/send-events/aws-cloudwatch.rst`:
- Line 48: The external HTTP call uses urllib.request.urlopen(req).read()
without a timeout; change the call to pass an explicit timeout (e.g.,
urllib.request.urlopen(req, timeout=5)) so the Lambda fails fast on network
issues; locate the usage of urllib.request.urlopen and the req variable in the
sample and add the timeout argument (and optionally handle
urllib.error.URLError/timeout exceptions where the .read() result is used).
In `@docs/configuration/exporting/send-events/github.rst`:
- Around line 27-31: Add an explicit security warning under the GitHub webhooks
URL-token example (the example URL containing ...?token=<ROBUSTA_API_KEY>)
stating that embedding tokens in URLs can leak via browser history, server logs,
and referrers; advise to prefer header-based authentication when available, and
if query-token must be used recommend scoping the token, rotating it frequently,
and using short-lived tokens or limited-permission API keys. Place this notice
immediately after the code block and keep it concise and prominent (e.g., a
warning admonition) so readers see the security guidance alongside the
token-in-URL example.
In `@docs/configuration/exporting/send-events/nagios.rst`:
- Line 31: Replace the plaintext API key in the Nagios notification command
sample (the "-H 'Authorization: Bearer <ROBUSTA_API_KEY>'" line) with a Nagios
resource macro such as "$USER20$"; update the surrounding text to instruct users
to define $USER20$ in a resource.cfg file and set restrictive file permissions
(600 or 660) and appropriate ownership so the secret is not exposed, and add a
short note advising that resource.cfg should be protected from backups and
unauthorized access per Nagios Core security best practices.
In `@docs/configuration/index.rst`:
- Around line 14-26: Update the card and toctree entries that reference the
legacy Send Alerts API so they point to the unified Send Events API: replace the
grid-item-card titled "Send Alerts API" (the card with :octicon:`code;1em;`) and
its :link value "exporting/send-alerts-api" with the new title "Send Events API"
and link "exporting/send-events-api", and change the inline description text
that currently mentions the legacy "/api/alerts" REST endpoint to a brief
statement about the unified Send Events API; also update the toctree entry
"exporting/send-alerts-api" to "exporting/send-events-api".
---
Nitpick comments:
In `@docs/configuration/exporting/send-events-api.rst`:
- Line 254: Add a trailing newline character at EOF for each of the seven RST
files listed (send-events-api.rst, dynatrace.rst, argocd.rst, opsgenie.rst,
alertmanager.rst, splunk.rst, pagerduty.rst) so they become POSIX-compliant text
files; open each file (e.g., send-events-api.rst) and ensure the last line ends
with a single '\n' character, save the file and commit the change.
In `@docs/configuration/exporting/send-events/launchdarkly.rst`:
- Line 27: Update the LaunchDarkly docs line that instructs appending
"&token=<ROBUSTA_API_KEY>" to the URL by adding a brief security warning: note
that query-parameter tokens can be exposed in server/proxy logs and browser
history, recommend using HMAC signing where supported instead, and advise using
scoped API keys with limited permissions plus a rotation policy to mitigate
exposure. Ensure the warning is adjacent to the existing LaunchDarkly guidance
so readers see the safer alternatives and key management recommendations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d76692e0-c444-4e6c-9f6e-583a582c459b
📒 Files selected for processing (23)
docs/configuration/exporting/robusta-pro-features.rstdocs/configuration/exporting/send-events-api.rstdocs/configuration/exporting/send-events/alertmanager.rstdocs/configuration/exporting/send-events/argocd.rstdocs/configuration/exporting/send-events/aws-cloudwatch.rstdocs/configuration/exporting/send-events/azure-monitor.rstdocs/configuration/exporting/send-events/datadog.rstdocs/configuration/exporting/send-events/dynatrace.rstdocs/configuration/exporting/send-events/gcp-monitoring.rstdocs/configuration/exporting/send-events/github.rstdocs/configuration/exporting/send-events/grafana.rstdocs/configuration/exporting/send-events/incidentio.rstdocs/configuration/exporting/send-events/launchdarkly.rstdocs/configuration/exporting/send-events/nagios.rstdocs/configuration/exporting/send-events/newrelic.rstdocs/configuration/exporting/send-events/opsgenie.rstdocs/configuration/exporting/send-events/pagerduty.rstdocs/configuration/exporting/send-events/rootly.rstdocs/configuration/exporting/send-events/sentry.rstdocs/configuration/exporting/send-events/solarwinds.rstdocs/configuration/exporting/send-events/splunk.rstdocs/configuration/index.rstdocs/index.rst
- argocd: add a concrete Application annotation snippet showing notifications.argoproj.io/subscribe.on-sync-failed.robusta and related triggers so the example is copy/paste-ready. - aws-cloudwatch: pass an explicit timeout to urllib.request.urlopen and catch URLError so the Lambda fails fast and surfaces network errors in CloudWatch logs. - github: add a security warning under the URL-token example covering log/history exposure and recommending scoped, rotated keys. - nagios: stop inlining the API key in commands.cfg; instead store it as $USER20$ in resource.cfg with file permissions and ownership guidance. - launchdarkly: add a security warning next to the URL-token guidance recommending HMAC signing and scoped, rotated keys.
naomi-robusta
changed the title
|
|
- Replace 'accepts any JSON payload' with 'accepts the default payload structure of the supported origins'. - Remove paragraph describing internal storage/parsing behavior. - Replace the 'Unsupported sources' section with a brief 'Other sources' note that does not mention parsers. - Drop incidental references to internal terminology in per-origin pages (per-origin/generic parser, the relay, dedup-key preservation). - Reorder all webhook URL examples to type, origin, account_id.
Theme ships only a subset of octicons; cloud, bell, git-branch, and flame fell through as literal text. Replace with server, pulse, package, and plug — all of which are used elsewhere in the docs and render correctly.
Only the alert type is supported today. Remove origins that only produce incidents (Rootly, Incident.io) or changes (Argo CD, GitHub, LaunchDarkly), drop the Incident Management → Rootly/ Incident.io and Changes & Deployments cards, simplify the type parameter to require 'alert', and rewrite PagerDuty for the AIOps alert flow only.
Update the origin parameter description to point at the Integrations list, and drop the 'Other sources' note that implied customers could pick any origin string.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/configuration/exporting/send-events/pagerduty.rst`:
- Line 33: Update the docs sentence that states "PagerDuty will sign the
payload, but Robusta authenticates on the API key alone — the signature is
ignored" by either (A) adding a brief architectural rationale and security
implications (explain why API-key-only was chosen, acknowledge risks of a single
compromised key, and advise mitigation steps such as key rotation, scoped keys,
rate limits and monitoring), or (B) implement signature validation in the
PagerDuty webhook processing path by adding a verify function (e.g.,
validate_pagerduty_signature or verify_pagerduty_webhook) called from the
PagerDuty webhook handler, plus a configuration flag (e.g.,
enable_pagerduty_signature_verification) and documentation showing how to add
the PagerDuty signing secret; then update the sentence to state that signatures
are validated when the flag is enabled and describe required config and behavior
on mismatch.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c117f3f3-0490-45ed-9baf-76e105ac90ae
📒 Files selected for processing (15)
docs/configuration/exporting/send-events-api.rstdocs/configuration/exporting/send-events/alertmanager.rstdocs/configuration/exporting/send-events/aws-cloudwatch.rstdocs/configuration/exporting/send-events/azure-monitor.rstdocs/configuration/exporting/send-events/datadog.rstdocs/configuration/exporting/send-events/dynatrace.rstdocs/configuration/exporting/send-events/gcp-monitoring.rstdocs/configuration/exporting/send-events/grafana.rstdocs/configuration/exporting/send-events/nagios.rstdocs/configuration/exporting/send-events/newrelic.rstdocs/configuration/exporting/send-events/opsgenie.rstdocs/configuration/exporting/send-events/pagerduty.rstdocs/configuration/exporting/send-events/sentry.rstdocs/configuration/exporting/send-events/solarwinds.rstdocs/configuration/exporting/send-events/splunk.rst
✅ Files skipped from review due to trivial changes (13)
- docs/configuration/exporting/send-events/splunk.rst
- docs/configuration/exporting/send-events/grafana.rst
- docs/configuration/exporting/send-events/newrelic.rst
- docs/configuration/exporting/send-events/datadog.rst
- docs/configuration/exporting/send-events/azure-monitor.rst
- docs/configuration/exporting/send-events/gcp-monitoring.rst
- docs/configuration/exporting/send-events/solarwinds.rst
- docs/configuration/exporting/send-events/dynatrace.rst
- docs/configuration/exporting/send-events/opsgenie.rst
- docs/configuration/exporting/send-events/alertmanager.rst
- docs/configuration/exporting/send-events-api.rst
- docs/configuration/exporting/send-events/sentry.rst
- docs/configuration/exporting/send-events/nagios.rst
🚧 Files skipped from review as they are similar to previous changes (1)
- docs/configuration/exporting/send-events/aws-cloudwatch.rst
The Execute an external program alert action takes one command line, so the ^ continuations were unnecessary.
Move the toctree above all H2 sections so the theme renders its entries directly under the page, not nested under the Programmatic Integration heading.
moshemorad
previously approved these changes
May 12, 2026
- Drop HMAC/signature-ignored note on PagerDuty page. - Replace Delivery Log mentions in every Verify section with a simple 'alert should appear on the Robusta timeline' line. - Trim the main page: remove HolmesGPT marketing sentence, the Response/Errors sections, rate-limit numbers, and the 401-on-mismatch note. - Collapse the Query Parameters table from four columns to two. - Shorten the Nagios resource.cfg security explanation. - Drop the 'token is an alternative to Authorization' meta note from the GCP page.
moshemorad
approved these changes
May 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds comprehensive documentation for the new Send Events API, a unified webhook endpoint for ingesting alerts, incidents, and changes from monitoring systems into Robusta. The documentation includes the main API reference and step-by-step integration guides for 18+ monitoring platforms.
Key Changes
New Send Events API documentation (
send-events-api.rst): Complete API reference including:Integration guides for 18 monitoring platforms:
alertmanager.rstEach integration guide includes:
Documentation structure updates:
Notable Implementation Details
alert,incident, andchangetoken) for platforms that don't support custom headershttps://claude.ai/code/session_01HiDKwRb85FXHRH39WhrEwS