Integrations Overview
Connect any monitoring tool to AlertFlow in minutes using native integrations or the generic webhook.
How integrations work
Every integration in AlertFlow has three components:
- Ingest endpoint — a unique HTTPS URL (
/api/inbound/webhook/<token>) that receives raw payloads from your tool via HTTP POST. - Field mappings — rules that normalize the raw payload into AlertFlow's standard format:
title,severity,status,clientName,labels. - Integration type — determines which pre-built parser runs on the payload. Native types (Kaseya VSA, ConnectWise, etc.) require zero configuration.
Supported integrations
Works with any tool that can POST JSON. Full field mapping control.
Native alarm ingest + outbound ticket creation.
Native alert ingest + service board ticket creation.
N-central and N-sight notification rules.
Orion trigger action webhook setup.
Datto RMM and PSA (Autotask) webhook setup.
Creating an integration
- 1Navigate to Integrations
In the AlertFlow dashboard, click Integrations in the left sidebar, then New Integration.
- 2Select a type
Choose the integration type that matches your monitoring tool. If your tool isn't listed, use Generic Webhook.
- 3Name and optionally assign a client
Give the integration a meaningful name (e.g., "Kaseya — Acme Corp"). Optionally assign it to a client — this populates
clientNameon every inbound alert automatically. - 4Copy the Webhook URL
After saving, copy the unique Webhook URL from the integration card. Paste this URL into your monitoring tool's notification/webhook settings.
- 5Test
Use the Test button in the integration modal, or send a manual
curlPOST, to verify alerts are arriving.
Alert severity mapping
AlertFlow normalizes severity to five levels. Native integrations handle this automatically; for generic webhooks you configure the mapping.
| AlertFlow severity | Common equivalents |
|---|---|
critical | P1, Emergency, Fatal, Alarm |
high | P2, High, Error |
medium | P3, Medium, Warning |
low | P4, Low, Notice |
info | P5, Info, Informational |
Deduplication
AlertFlow deduplicates alerts using a fingerprint — a hash of title + source + organizationId. If a duplicate arrives while the original is still firing, it increments the dedupCount counter instead of creating a new alert. This prevents alert storms from filling the dashboard.
You can override the fingerprint by sending a fingerprint or dedup_key field in the payload.
Rate limits
Ingest endpoints accept up to 60 requests per minute per token. Bursts above this return 429 Too Many Requests. The Retry-After header tells you when to retry.