Documentation Grafana Cloud Alerts and IRM Workflows Step and trigger types reference Event payloads

Sample event payloads

Workflows receive events in CloudEvents shape. Use this page to understand the payload your workflows match against and to write CEL expressions that read fields from the triggering event.

Event envelope

Every event delivered to a workflow has the same top-level shape:

JSON Copy

{
  "id": "<message-id>",
  "type": "<event-name>",
  "source": "<app>/<instance-id>",
  "time": "<RFC 3339 timestamp>",
  "data": { }
}

The contents of data depend on the event type. The remaining sections describe the supported event types.

Incident events

Trigger pattern: grafana_irm_app.incident.updated.

JSON Copy

{
  "id": "msg-1",
  "type": "grafana_irm_app.incident.updated",
  "source": "grafana_irm_app/100",
  "time": "2026-04-22T12:00:00Z",
  "data": {
    "incidentID": "INC-123",
    "eventKind": "incident_updated_severity",
    "orgID": "100"
  }
}

The data object includes the following fields:

When a workflow triggers on an incident event, the engine automatically loads the full incident and exposes it as resources.incident.event. For details and the available incident fields, refer to Load incident data.

Key update events

When someone posts or edits a key update on an incident, the event arrives with the same trigger pattern, grafana_irm_app.incident.updated. Use the eventKind field to tell key update events apart from other incident updates:

• incident_added_key_update fires when a new key update is posted.
• incident_updated_key_update fires when an existing key update is edited.

JSON Copy

{
  "id": "msg-1",
  "type": "grafana_irm_app.incident.updated",
  "source": "grafana_irm_app/100",
  "time": "2026-05-12T14:20:00Z",
  "data": {
    "incidentID": "INC-123",
    "eventKind": "incident_added_key_update",
    "orgID": "100",
    "keyUpdateID": "019f8583-a717-771b-9f98-e84e17c6cfd9",
    "title": "",
    "content": "Primary database restored. Monitoring for recurrence.",
    "newStatus": "Resolved",
    "previousStatus": "Active",
    "newSeverity": "Critical"
  }
}

In addition to the standard incident event fields, the data object includes the following fields:

To trigger a workflow only on key update events, add a condition on eventKind:

text Copy

inputs.data.eventKind == 'incident_added_key_update'

Reference incident event fields

text Copy

inputs.data.incidentID
inputs.data.eventKind
resources.incident.event.title
resources.incident.event.severity
resources.incident.event.status

Alert group events

Trigger pattern: grafana_irm_app.alertgroup.updated.

JSON Copy

{
  "id": "msg-1",
  "type": "grafana_irm_app.alertgroup.updated",
  "source": "grafana_irm_app/11012",
  "time": "2026-04-23T02:57:15Z",
  "data": {
    "alertGroupID": "IXXDXP5KHEGRY",
    "orgID": "11012",
    "eventKind": "resolved",
    "alertGroup": {
      "id": "IXXDXP5KHEGRY",
      "state": "resolved"
    }
  }
}

The data object includes the following fields:

When a workflow triggers on an alert group event, the engine automatically loads the alert group and exposes it as resources.alertgroup.event. For details and the available alert group fields, refer to Load alert group data.

Reference alert group event fields

text Copy

inputs.data.alertGroupID
inputs.data.eventKind
inputs.data.alertGroup.state
resources.alertgroup.event.title

Schedule events

Trigger pattern: grafana_irm_app.schedule.updated.

JSON Copy

{
  "id": "msg-1",
  "type": "grafana_irm_app.schedule.updated",
  "source": "grafana_irm_app/100",
  "time": "2026-04-22T12:00:00Z",
  "data": { }
}

The schedule event fires when the current on-call users change. The exact data fields produced by this event are not yet documented for private preview customers. To work with the current on-call users in a workflow, use the irm.schedule-current-oncall step to look them up by schedule ID, regardless of which schedule fired the event.

Manual triggers

When you click Run in the editor, the Trigger Workflow dialog prefills a manual event in the same envelope shape:

JSON Copy

{
  "id": "example-message-id",
  "type": "grafana-workflows.<orgID>.run.manual",
  "source": "grafana-workflows/<orgID>",
  "time": "<current time>",
  "data": { }
}

You edit the data object to match the shape of the event you want to simulate, for example, an incident event payload from this page. For details on manual triggers, refer to Configure triggers.

Next steps

• Configure triggers
• Use CEL expressions
• Load incident data
• Load alert group data