Prerequisites
You need permission to add webhooks in Corelayer and configure webhooks in incident.io.Setup
1. Get the URL
In Corelayer, open Webhooks and click Add Webhook. Set Webhook type to incident.io, enter a Source name such asProduction incidents, and click Next.
Copy the Webhook URL. Keep the form open while you configure incident.io in another tab.
2. Add the endpoint in incident.io
In incident.io, go to Settings → Webhooks, click Add endpoint, and paste the Corelayer URL. Subscribe to the events you want Corelayer to receive:
Save the endpoint, then copy its Signing Secret.
If you’re updating an endpoint that only sends alerts, add the incident-created events to receive declared incidents. Existing subscriptions are not updated automatically.
3. Finish setup
Return to Corelayer. Paste the signing secret (whsec_...) into Webhook signing secret and click Create Webhook.
After a subscribed event occurs, open the endpoint’s delivery attempts in incident.io and check the response from Corelayer. A successful delivery confirms receipt; it does not mean the investigation has finished.
After delivery
Created alerts and declared incidents are sent for investigation. Alert resolutions are recorded but do not automatically close Corelayer issues. Other event types, including incident updates, are accepted and ignored. Updates do not continue an existing investigation, and Corelayer does not write changes back to incident.io.Declared incidents
Investigations use the incident reference and name, for exampleINC-123: Checkout returning 500s, with the summary as the description and a link back to incident.io.
Severity and status are recorded as labels because their definitions vary between incident.io workspaces. Incident type, mode, visibility, Slack channel, role assignments, and custom fields are also included as labels.
Test incidents are investigated too, with the label incidentio.mode: test.
See Manage sources to change or remove this source.
Troubleshooting
No delivery appears in incident.io
Check the endpoint’s event subscriptions. Alert subscriptions do not include declared incidents; those need the public or privateincident_created_v2 event from the table above.
A delivery fails
Open the failed delivery in incident.io and inspect the HTTP response:401: Check that the signing secret matches this endpoint’s secret.403: The webhook is disabled.404: Check that incident.io has the exact URL Corelayer issued and that the webhook still exists.
No investigation starts
Check the event type first. Resolution events are recorded, and unsupported event types are ignored. Repeated alerts can also be suppressed as duplicates. Your Corelayer organization must finish onboarding before alerts can be investigated. If the response reportsskipped_onboarding, complete onboarding and send a new alert.
Need help? Contact support.