Ops Webhooks

Ops events use the same webhook system as the rest of Eridian. Subscribe on /v1/webhooks with Ops types. Signing, retries, and replay are documented in Webhooks and Webhook Signing.

Event types

Sample payload

{
  "id": "evt_ops_55",
  "object": "eridian.webhook.event",
  "type": "ops.incident.opened",
  "created_at": 1718400000,
  "project_id": "prj_ops_001",
  "data": {
    "incident_id": "inc_2847",
    "service_id": "svc_payments_api",
    "severity": "sev1",
    "region": "eu-west-1",
    "route": null
  }
}

route is null until a model runs. ops.incident.summarized includes route: gpt or gemini.

Subscribe

POST /v1/webhooks
Authorization: Bearer eridian_sk_...

{
  "project_id": "prj_ops_001",
  "url": "https://siem.example.bank/webhooks/eridian-ops",
  "events": [
    "ops.incident.opened",
    "ops.incident.closed",
    "ops.slo.burn",
    "ops.connector.lag"
  ]
}

Required scope: governance:manage. HTTPS only.

SIEM

For high volume, prefer GET /v1/ops/incidents with cursor pagination plus ops.incident.opened as a wake-up, rather than stuffing summaries into Slack. Do not subscribe to ops.oncall.query.completed unless you need every assistant turn in the SIEM. Those payloads omit answer text on ZDR; you get ids only.

See Observability for gateway metrics, which are separate from Ops vertical events.