Events Ingest

Public alert-ingest endpoint for Incident Management. Post any JSON alert payload from your own monitoring or alerting system; it is queued and processed asynchronously into an incident.

POST /api/im/events

Accepts an arbitrary JSON alert payload from your own monitoring or alerting system and queues it for asynchronous processing into Incident Management. This is the primary integration endpoint for pushing alerts from third-party systems.

Authentication

Requires an organization-wide API token (Authorization: Bearer wsm_..., created without a customerId, see Create Organization Token). A customer-scoped token is rejected with 403 Forbidden (imAccessDenied). Incident Management must also be activated for the organization, or the request is rejected with 403 Forbidden (imNotEnabled).

Rate limit

600 requests per minute per organization, not per IP. A monitoring system that fans out across many source IPs shares one quota with its organization.

Request Body

Any JSON object. The payload is stored against an api-type alert source that is auto-provisioned for your organization the first time you call this endpoint, and mapped into an alert using that source's field mapping. There is no fixed request schema. Send whatever your alerting system produces.

Limits, enforced before the payload is queued:

Limit	Value	Failure
Body size	256 KB	`413 Payload Too Large` (`payloadTooLarge`)
JSON nesting depth	20 levels	`422 Payload too deep` (`payloadTooDeep`)
Body must be valid JSON	—	`422 Invalid JSON` (`invalidJson`)

An empty request body is treated as {}.

Example (cURL)

curl -X POST "$BASE_URL/api/im/events" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Database connection pool exhausted",
    "severity": "critical",
    "host": "db-primary-01"
  }'

Response

202 Accepted: the alert has been queued, not yet processed. There is no synchronous incident or alert ID in the response.

{
  "accepted": true
}

Common errors

401 Unauthorized when not authenticated
403 Forbidden (imAccessDenied) when using a customer-scoped token, or a session without an IM-eligible role
403 Forbidden (imNotEnabled) when Incident Management is not enabled for the organization
413 Payload Too Large (payloadTooLarge) when the body exceeds 256 KB
422 Invalid JSON (invalidJson) when the body is not valid JSON
422 Payload too deep (payloadTooDeep) when the parsed JSON nests more than 20 levels
429 Too Many Requests when your organization exceeds 600 requests/minute (see retryAfter in the response body)
503 Service Unavailable (unavailable) when the alert could not be queued, safe to retry