Incident Management Platform · View 11 of 34 · 3 · Structure
Decisions
- Three inbound transports only: HTTPS webhook with a per-integration HMAC signature, SMTP to a per-integration address, and the REST API. A small number of documented transports is what makes every integration independently revocable.
- The on-call lookup endpoint is served from the paging cells, from the same coverage snapshot the dispatcher reads, so automation that asks who is on call during an incident gets the paging path's availability rather than the console's.
- The outbound lifecycle stream is at-least-once with an idempotency key per event. Consumers that cannot deduplicate are served by a small webhook relay that does it for them.
Contracts
- Every inbound call returns an alert id within the request. A 429 names the integration's quota and a retry-after; a malformed payload returns 202 and goes to quarantine, because a sender told 400 will stop sending and a real alert will be lost.
Deliberately out
- Bidirectional chat commands that change incident state without an attributed actor. Chat is a place to talk; state changes go through the API, which records who made them.
