Incident response war room

Add an Events API v2 integration

Services → Service Directory → your service → Integrations → Add another integration → Events API V2. Copy what the UI labels the Integration Key; that is the routing_key your monitors post to. One integration per service keeps it rotatable without a global outage of alerting.

{
  "routing_key": "R02A9F4C7E1B84D3F",
  "event_action": "trigger",
  "dedup_key": "checkout-api-5xx",
  "payload": {
    "summary": "checkout-api 5xx rate 14% over 5m (threshold 2%)",
    "severity": "critical",
    "source": "checkout-api.prod.us-east-1",
    "component": "payments",
    "group": "checkout",
    "class": "http-error-rate"
  },
  "links": [{ "href": "https://grafana.acme.com/d/checkout", "text": "Checkout dashboard" }]
}

Subscribe to incident webhooks

Integrations → Generic Webhooks (v3) → New webhook → scope it to the service → events: incident.triggered, incident.acknowledged, incident.resolved. Verify the X-PagerDuty-Signature header on every delivery.

Only spin up a room for SEV1 and SEV2

Map PagerDuty severity to your SEV scale, then express the gate as conditions on the incident-channel rule below (by priority, service or team) rather than as an if-statement in your code. A war room per warning alert leaves you with 200 dead channels and a workspace nobody can search.

critical -> SEV1   channel rule fires, page secondary, notify #general
error    -> SEV2   channel rule fires, page secondary
warning  -> SEV3   thread in #ops only, no channel
info     ->        ignore

Let PagerDuty open the war room

Do not write this part. PagerDuty → Integrations → Extensions → Slack → your workspace → Incident Channel tab → turn on "Automatically create incident channels". Set the name template (inc-{{incident.incident_number}} — Slack names are lowercase, no spaces, 80 characters max, so keep the template fixed and search still works six months later), scope it with the priority/service/team conditions from the severity gate, and let it handle the invites, the incident bookmark and the status updates. Then still post one message naming IC, comms owner and scribe and pins.add it: every incident review that goes badly starts with "who was actually running this?".

Add your own app for the timeline

The native integration owns the room; your app only needs to read and write in it. Add the scopes below, subscribe to the message.channels event, and get the app into each incident channel — a message subscription only delivers channels the app is a member of. If you cannot use the PagerDuty Slack integration, you can still create the room yourself with conversations.create, conversations.invite and conversations.setPurpose (add channels:manage), taking the channel id from the create response and never hardcoding it.

channels:history   # read the !log messages (with the message.channels event)
channels:read      # resolve the incident channel id
chat:write         # post the roles header and the postmortem link
pins:write         # pin that header
users:read         # turn member ids into the responder list

Capture the timeline with a keyword

Ask responders to prefix decisive messages with "!log". Collect those from the message events; you get a human-curated timeline for free instead of parsing 400 messages afterwards.

21:47Z  !log alert fired, 5xx at 14%
21:49Z  !log rolled back deploy 4f21ac
21:52Z  !log error rate back under 1%, watching
22:05Z  !log status page updated, incident resolved

Create the "Incidents" database

Properties: Name (Title), Incident ID (Text), Severity (Select: SEV1/SEV2/SEV3), Detected At (Date with time), Resolved At (Date with time), Duration mins (Formula), Services (Multi-select), Responders (Person), Root Cause (Text), Action Items (Text), Status (Select: Draft / In review / Complete).

Let Notion compute the duration

Add the formula below to Duration mins. Deriving it beats storing it — a corrected Resolved At then fixes the number everywhere at once.

if(
  empty(prop("Resolved At")),
  toNumber(""),
  dateBetween(prop("Resolved At"), prop("Detected At"), "minutes")
)

Create the page on resolve, not on trigger

On incident.resolved, POST /v1/pages with Notion-Version: 2026-03-11 — retrieve the Incidents database first and parent the page on its data_source_id, not the database id. Body is the timeline, Detected/Resolved come from the PagerDuty timestamps. Responders is a Person property and takes Notion user ids: Slack member ids will not resolve into it, so keep a slack-to-notion map (the same shape as the reviewer map in the PR pipeline) or fall back to a Text property rather than shipping a column that is always empty. Leave Root Cause empty on purpose — that section is the human's job, and a pre-filled guess anchors the whole review.

Archive the channel with a link

Post the postmortem URL into the war room, then archive the channel after 48 hours. The channel history stays searchable; the sidebar stays usable.