Integrations

Connect Runframe to your existing monitoring, alerting, and communication tools.

Overview

Runframe integrates with the tools you already use to create incidents automatically and streamline incident response. Reduce toil and ensure no alert goes unnoticed.

Why integrate?

Slack

Runframe's deepest integration is with Slack, your incident command center.

Features

Installation

1. Visit the Slack App Directory or use the link from your Runframe dashboard
2. Click Add to Slack
3. Grant Runframe permissions:
   • Create channels
   • Send messages
   • View user information
4. Complete installation and sign in to Runframe

Slash commands

Once installed, use these commands from any Slack channel:

See the Slash Commands guide for complete documentation.

Incident channel naming

Runframe creates incident channels with a consistent naming pattern:

{incident-number}-{title-slug}

Example: inc-00042-api-latency-spike

The channel name is derived from the incident number and a slugified version of the title (max 80 characters).

Datadog

Create incidents automatically from Datadog monitors and alerts.

Setup from Runframe

1. Navigate to Settings → Integrations
2. Click Connect next to Datadog — this generates a unique webhook URL for your organization
3. Copy the webhook URL (format: https://api.runframe.io/webhooks/{routingKey})
4. Link services to route Datadog alerts to specific Runframe services

Setup from Datadog

1. In Datadog, navigate to Integrations → Webhooks
2. Create a new webhook with your Runframe webhook URL
3. Add the service_id tag to your monitors (e.g., service_id:SER-00001)
4. Customize the payload to include incident details
5. Associate the webhook with your monitors

Datadog to Runframe field mapping

Datadog severity mapping

Configure how Datadog alert priorities map to Runframe severities:

Sentry

Create incidents from Sentry error events and alerts.

Sentry setup

1. Navigate to Settings → Integrations
2. Click Connect next to Sentry — this generates a unique webhook URL for your organization
3. Copy the webhook URL (format: https://api.runframe.io/webhooks/{routingKey})
4. Link services to route Sentry alerts to specific Runframe services
5. Configure which projects and alert rules should create incidents

Sentry to Runframe field mapping

Sentry severity mapping

Prometheus

Create incidents from Prometheus alert rules via Alertmanager.

Prometheus setup

1. Navigate to Settings → Integrations
2. Click Connect next to Prometheus — this generates a unique webhook URL for your organization
3. Copy the webhook URL (format: https://api.runframe.io/webhooks/{routingKey})
4. Link services to route Prometheus alerts to specific Runframe services
5. In Alertmanager, configure a webhook receiver with your Runframe URL

Alertmanager configuration

receivers:
  - name: 'runframe'
    webhook_configs:
      - url: 'https://api.runframe.io/webhooks/YOUR_ROUTING_KEY'
        send_resolved: true

Associate the receiver with your alert routes.

Prometheus to Runframe field mapping

Prometheus severity mapping

Alertmanager configuration example

route:
  group_by: ['alertname', 'cluster', 'service']
  group_wait: 10s
  group_interval: 10s
  repeat_interval: 12h
  receiver: 'runframe'

receivers:
  - name: 'runframe'
    webhook_configs:
      - url: 'https://api.runframe.io/webhooks/YOUR_ROUTING_KEY'
        send_resolved: true

AWS CloudWatch

Create incidents automatically from CloudWatch alarms via SNS.

How it works

CloudWatch alarms publish to an SNS topic, which POSTs to Runframe's webhook endpoint. Runframe verifies the SNS signature, auto-confirms the subscription, and parses the alarm payload to create or resolve incidents.

CloudWatch Alarm → SNS Topic → POST /webhooks/{routingKey} → Runframe Incident

CloudWatch setup

1. Navigate to Settings → Integrations
2. Click Connect next to CloudWatch — this generates a unique webhook URL for your organization
3. Copy the webhook URL (format: https://api.runframe.io/webhooks/{routingKey})

AWS setup

1. Create an SNS topic in the same region as your CloudWatch alarms
2. Add a subscription to the SNS topic:
   • Protocol: HTTPS
   • Endpoint: Your Runframe webhook URL
3. Runframe automatically confirms the SNS subscription (no manual action needed)
4. Configure your CloudWatch alarms to send notifications to the SNS topic
5. Add a service_id dimension to your metrics for automatic service routing

CloudWatch to Runframe field mapping

CloudWatch alarm state mapping

Security

CloudWatch webhooks are verified using two layers:

1. SNS signature verification — Runframe cryptographically verifies every SNS message using the certificate-based RSA signature (supports SignatureVersion 1 and 2)
2. Routing key — The secret URL acts as an additional authentication layer

PagerDuty

Jira

Track incident-related work items and action items directly in Jira.

Connecting Jira

1. Navigate to Settings → Integrations → Jira
2. Click Connect Jira — you'll be redirected to Atlassian to authorize
3. Grant Runframe read/write access to your Jira projects
4. Select the default Jira project for incident work items

Features

Creating a Jira issue from an incident

1. Open an incident in the Runframe dashboard
2. Click Create Jira Issue in the sidebar
3. Select the project, issue type, and fill in details
4. The issue is created and linked to the incident

Google Meet

Automatically create Google Meet war rooms for incident coordination.

Connecting Google Meet

1. Navigate to Settings → Integrations → Google Meet
2. Click Connect Google Meet — you'll be redirected to Google to authorize
3. Grant Runframe permission to create meetings on your behalf

How it works

When an incident is created, Runframe can automatically create a Google Meet link and share it in the incident Slack channel. This gives responders an instant video call for coordination.

Configuration

Custom Webhook

Create incidents from any HTTP source — custom scripts, CI/CD pipelines, Terraform, Zapier, n8n, or any tool that can make an HTTP POST.

Custom webhook setup

1. Navigate to Settings → Integrations → Custom Webhook
2. Click Connect — this generates a unique webhook URL for your organization
3. Copy the webhook URL (format: https://api.runframe.io/webhooks/{routingKey})
4. Configure your tool to POST JSON to this URL

Webhook payload format

Send a JSON payload with these fields:

{
  "title": "High memory usage on production servers",
  "service_id": "SER-00001",
  "description": "Memory usage above 90% on 3 servers",
  "severity": "SEV1",
  "status": "new",
  "source_url": "https://grafana.example.com/dashboard/abc",
  "dedup_key": "mem-alert-prod-001",
  "metadata": {
    "environment": "production",
    "region": "us-east-1"
  }
}

Required and optional fields

Deduplication

• If dedup_key is provided, subsequent POSTs with the same key update the existing incident instead of creating a new one
• If dedup_key is omitted, every POST creates a new incident

HMAC signature verification (optional)

For stronger security beyond the routing key, enable HMAC-SHA256 signing:

1. Generate a signing secret in the integration settings
2. Include two headers with each request:

X-Runframe-Signature: sha256=<hex HMAC of timestamp.body>
X-Runframe-Timestamp: <unix seconds>

The signature is computed as HMAC-SHA256(signingSecret, "${timestamp}.${body}").

Runframe rejects requests with timestamps older than 5 minutes to prevent replay attacks.

Example: curl

curl -X POST https://api.runframe.io/webhooks/YOUR_ROUTING_KEY \
  -H "Content-Type: application/json" \
  -d '{
    "title": "High memory usage on production servers",
    "service_id": "SER-00001",
    "description": "Memory usage above 90% on 3 servers",
    "severity": "SEV1"
  }'

Example: curl with HMAC signing

TIMESTAMP=$(date +%s)
BODY='{"title":"Deploy failed","service_id":"SER-00002","severity":"SEV2"}'
SIGNATURE=$(echo -n "${TIMESTAMP}.${BODY}" | openssl dgst -sha256 -hmac "your-signing-secret" | awk '{print $2}')

curl -X POST https://api.runframe.io/webhooks/YOUR_ROUTING_KEY \
  -H "Content-Type: application/json" \
  -H "X-Runframe-Signature: sha256=${SIGNATURE}" \
  -H "X-Runframe-Timestamp: ${TIMESTAMP}" \
  -d "${BODY}"

API

Build custom integrations with the Runframe REST API.

Authentication

All API requests require an API key:

curl https://api.runframe.io/v1/incidents \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Create an incident

curl https://api.runframe.io/v1/incidents \
  -X POST \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "API latency spike",
    "severity": "SEV1",
    "description": "API response times > 5s",
    "affectedServices": ["SERVICE_UUID_HERE"],
    "customerFacing": true
  }'

Update an incident

curl https://api.runframe.io/v1/incidents/INC-042 \
  -X PATCH \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "identified"
  }'

See the API reference for complete documentation.

Testing integrations

After setting up an integration, verify it works correctly.

Test incident creation

1. Trigger a test alert from your monitoring tool (or use curl for Custom Webhook)
2. Verify Runframe creates the incident
3. Check that field mapping is correct (title, severity, service routing)
4. Confirm the right people were notified

Webhook event logs

Runframe logs all incoming webhook events for debugging:

• Navigate to Settings → Integrations
• View recent webhook deliveries and any parsing errors

Best practices

Integration strategy

Do:

• Start simple – Begin with 1 to 2 critical integrations
• Test thoroughly – Verify integrations work before relying on them
• Document customizations – Keep records of field mappings and severity rules
• Monitor health – Check integration status regularly

Don't:

• Don't create duplicate incidents – Deduplicate alerts from multiple sources
• Don't over-automate – Manual control for high-severity incidents
• Don't ignore errors – Failed webhooks need investigation
• Don't set and forget – Review integration quarterly

Reducing alert noise

Integrations can create too many incidents. Reduce noise:

• Aggregate alerts – Group similar alerts into a single incident
• Set thresholds – Only create incidents for alerts exceeding severity
• Time-based windows – Suppress repeated alerts within a time window
• Smart deduplication – Link duplicate incidents instead of creating new ones

Need more?

• Slash Commands – Complete /inc command reference
• Incidents – Incident lifecycle and severity
• On-Call – Scheduling and rotations
• Webhooks – Custom webhook integrations
• Web Dashboard – Integration management UI