Datadog

Navi.sh has a native Datadog integration that parses monitor alert webhook payloads directly — no template configuration needed.

POST/v1/events/datadog/{token}

Setup in Datadog

1. In the Navi.sh dashboard, go to Integrations → Datadog and copy your integration URL.
2. In Datadog, go to Integrations → Webhooks.
3. Click New Webhook and fill in:
   • Name: navi-sh (or any name you like)
   • URL: the integration URL you copied above (format: https://api.navi.sh/v1/events/datadog/<token>).
4. Leave the Payload field as the Datadog default — Navi.sh reads the native format.
5. Click Save.
6. In each monitor you want to route to Navi.sh, add the webhook as a notification channel: @webhook-navi-sh.

Auto-resolve

Incidents auto-resolve when Datadog sends a recovery webhook with:

• alert_transition: "Recovered", or
• alert_type: "success"

Navi.sh correlates trigger and recovery events using (in order of preference):

1. alert_cycle_key
2. aggregation_key
3. alert_id
4. id (fallback — datadog-<id>)

POST /v1/events/datadog/{token}

Accepts Datadog monitor alert webhook payloads. Configure this URL in Integrations → Webhooks within your Datadog account.

Incidents auto-resolve when alert_transition is "Recovered" or alert_type is "success". Deduplicates via alert_cycle_key, aggregation_key, alert_id, or id (in that order).

The token is generated in your navi.sh workspace under Integrations.

Payload schema

Field	Type	Description
aggreg_key	string	Alias used by Datadog's template variable naming. (example: cpu-web-01)
aggregation_key	string	Key used to aggregate related events. (example: cpu-web-01)
alertCycleKey	string	Camel-case alias for alert_cycle_key. (example: cycle-abc-123)
alertTransition	string (Triggered, Recovered, No Data)	Camel-case alias for alert_transition. (example: Triggered)
alert_cycle_key	string	Links trigger and recovery events in the same alert lifecycle. (example: cycle-abc-123)
alert_id	string	Datadog alert ID. (example: 123456789)
alert_metric	string	Metric name that triggered the alert. (example: system.cpu.user)
alert_query	string	The monitor query expression. (example: avg(last_5m):avg:system.cpu.user{host:web-01} > 90)
alert_scope	string	Comma-separated tag scope that triggered the condition. (example: host:web-01,env:prod)
alert_transition	string (Triggered, Recovered, No Data)	Lifecycle transition. Recovered or success signals auto-resolve. (example: Triggered)
alert_type	string (error, warning, success, info)	Alert type. (example: error)
body	string	Alias used by some Datadog webhook templates. (example: CPU usage crossed 90% threshold on web-01)
date	integer	Unix epoch timestamp (seconds). (example: 1.7053122e+09)
event_text	string	Alert message text. (example: CPU usage crossed 90% threshold on web-01)
event_title	string	Monitor alert title. (example: [Triggered] CPU usage > 90%)
event_type	string	Datadog event type. (example: monitor_alert)
hostname	string	Source hostname. (example: web-01.us-east-1)
id	integer	Numeric Datadog event ID. (example: 1.23456789e+08)
link	string	Direct link to the alert in Datadog. (example: https://app.datadoghq.com/monitors/123456789)
monitor_name	string	Name of the Datadog monitor. (example: CPU usage on web-01)
priority	string (normal, low)	Alert priority. (example: normal)
snapshot	string	URL to a graph snapshot image of the alerting metric. (example: https://p.datadoghq.com/sb/abc-snapshot.png)
source_type_name	string	Datadog source type name. (example: MONITOR_ALERT)
tags	array of string	List of key:value tags attached to the alert. (example: [env:prod team:backend])
title	string	Alias used by some Datadog webhook templates. (example: [Triggered] CPU usage > 90%)

Examples

Monitor Triggered

{
  "alert_id": "12345678",
  "alert_transition": "Triggered",
  "alert_type": "error",
  "date": 1705312200,
  "event_text": "Error rate is above 5% for the last 10 minutes",
  "event_title": "High error rate on api service",
  "hostname": "api-01.prod",
  "id": 987654321,
  "monitor_name": "API Error Rate Monitor",
  "priority": "normal",
  "tags": [
    "env:production",
    "service:api"
  ]
}

Response codes

• 202 — Accepted — processing is asynchronous
• 400 — Invalid request body (malformed JSON or wrong content type)
• 401 — Invalid service token
• 500 — Unexpected server error