> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corelayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# incident.io

> Send incident.io alerts and declared incidents to Corelayer for investigation.

You'll copy a URL from Corelayer into incident.io, then bring the endpoint's signing secret back to Corelayer.

## Prerequisites

You need permission to add webhooks in Corelayer and configure webhooks in incident.io.

## Setup

### 1. Get the URL

In Corelayer, open **Webhooks** and click **Add Webhook**. Set **Webhook type** to **incident.io**, enter a **Source name** such as `Production incidents`, and click **Next**.

Copy the **Webhook URL**. Keep the form open while you configure incident.io in another tab.

### 2. Add the endpoint in incident.io

In incident.io, go to **Settings → Webhooks**, click **Add endpoint**, and paste the Corelayer URL.

Subscribe to the events you want Corelayer to receive:

| Event type                             | What Corelayer does                |
| -------------------------------------- | ---------------------------------- |
| `public_alert.alert_created_v1`        | Investigates the alert             |
| `private_alert.alert_created_v1`       | Investigates the alert             |
| `public_alert.alert_resolved_v1`       | Records the resolution event       |
| `private_alert.alert_resolved_v1`      | Records the resolution event       |
| `public_incident.incident_created_v2`  | Investigates the declared incident |
| `private_incident.incident_created_v2` | Investigates the declared incident |

Save the endpoint, then copy its **Signing Secret**.

If you're updating an endpoint that only sends alerts, add the incident-created events to receive declared incidents. Existing subscriptions are not updated automatically.

### 3. Finish setup

Return to Corelayer. Paste the signing secret (`whsec_...`) into **Webhook signing secret** and click **Create Webhook**.

After a subscribed event occurs, open the endpoint's delivery attempts in incident.io and check the response from Corelayer. A successful delivery confirms receipt; it does not mean the investigation has finished.

## After delivery

Created alerts and declared incidents are sent for investigation. Alert resolutions are recorded but do not automatically close Corelayer issues.

Other event types, including incident updates, are accepted and ignored. Updates do not continue an existing investigation, and Corelayer does not write changes back to incident.io.

### Declared incidents

Investigations use the incident reference and name, for example `INC-123: Checkout returning 500s`, with the summary as the description and a link back to incident.io.

Severity and status are recorded as labels because their definitions vary between incident.io workspaces. Incident type, mode, visibility, Slack channel, role assignments, and custom fields are also included as labels.

Test incidents are investigated too, with the label `incidentio.mode: test`.

See [Manage sources](/webhooks/overview#manage-sources) to change or remove this source.

## Troubleshooting

### No delivery appears in incident.io

Check the endpoint's event subscriptions. Alert subscriptions do not include declared incidents; those need the public or private `incident_created_v2` event from the table above.

### A delivery fails

Open the failed delivery in incident.io and inspect the HTTP response:

* `401`: Check that the signing secret matches this endpoint's secret.
* `403`: The webhook is disabled.
* `404`: Check that incident.io has the exact URL Corelayer issued and that the webhook still exists.

### No investigation starts

Check the event type first. Resolution events are recorded, and unsupported event types are ignored. Repeated alerts can also be suppressed as duplicates.

Your Corelayer organization must finish onboarding before alerts can be investigated. If the response reports `skipped_onboarding`, complete onboarding and send a new alert.

Need help? [Contact support](mailto:support@corelayer.com).


## Related topics

- [Overview](/webhooks/overview.md)
- [Custom alerts](/webhooks/custom.md)
- [Corelayer Changelog: April 2026 Release](/changelog/april-2026.md)