---
title: "Events Ingest"
description: "Public alert-ingest endpoint for Incident Management. Post any JSON alert payload from your own monitoring or alerting system; it is queued and processed asynchronously into an incident."
---

`POST /api/im/events`

Accepts an arbitrary JSON alert payload from your own monitoring or alerting system and queues it for asynchronous processing into Incident Management. This is the primary integration endpoint for pushing alerts from third-party systems.

## Authentication

Requires an **organization-wide** API token (`Authorization: Bearer wsm_...`, created without a `customerId`, see [Create Organization Token](/api/api-tokens/create-organization-token)). A customer-scoped token is rejected with `403 Forbidden` (`imAccessDenied`). Incident Management must also be activated for the organization, or the request is rejected with `403 Forbidden` (`imNotEnabled`).

## Rate limit

600 requests per minute per organization, not per IP. A monitoring system that fans out across many source IPs shares one quota with its organization.

## Request Body

Any JSON object. The payload is stored against an `api`-type alert source that is auto-provisioned for your organization the first time you call this endpoint, and mapped into an alert using that source's field mapping. There is no fixed request schema. Send whatever your alerting system produces.

Limits, enforced before the payload is queued:

| Limit | Value | Failure |
|-------|-------|---------|
| Body size | 256 KB | `413 Payload Too Large` (`payloadTooLarge`) |
| JSON nesting depth | 20 levels | `422 Payload too deep` (`payloadTooDeep`) |
| Body must be valid JSON | — | `422 Invalid JSON` (`invalidJson`) |

An empty request body is treated as `{}`.

## Example (cURL)

```bash
curl -X POST "$BASE_URL/api/im/events" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Database connection pool exhausted",
    "severity": "critical",
    "host": "db-primary-01"
  }'
```

## Response

`202 Accepted`: the alert has been queued, not yet processed. There is no synchronous incident or alert ID in the response.

```json
{
  "accepted": true
}
```

## Common errors

- `401 Unauthorized` when not authenticated
- `403 Forbidden` (`imAccessDenied`) when using a customer-scoped token, or a session without an IM-eligible role
- `403 Forbidden` (`imNotEnabled`) when Incident Management is not enabled for the organization
- `413 Payload Too Large` (`payloadTooLarge`) when the body exceeds 256 KB
- `422 Invalid JSON` (`invalidJson`) when the body is not valid JSON
- `422 Payload too deep` (`payloadTooDeep`) when the parsed JSON nests more than 20 levels
- `429 Too Many Requests` when your organization exceeds 600 requests/minute (see `retryAfter` in the response body)
- `503 Service Unavailable` (`unavailable`) when the alert could not be queued, safe to retry