--- title: "Sample event payloads | Grafana Cloud documentation" description: "Reference samples of the CloudEvents-shaped payloads delivered to Grafana Workflows for incident, alert group, and schedule events." --- > For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt). # Sample event payloads > Note > > Grafana Workflows is currently in [private preview](/docs/release-life-cycle/). Grafana Labs offers support on a best-effort basis, and breaking changes might occur prior to the feature being made generally available. Workflows receive events in [CloudEvents](https://cloudevents.io/) shape. Use this page to understand the payload your workflows match against and to write CEL expressions that read fields from the triggering event. ## Event envelope Every event delivered to a workflow has the same top-level shape: JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "id": "", "type": "", "source": "/", "time": "", "data": { } } ``` Expand table | Field | Description | |----------|-----------------------------------------------------------------------------------------------------| | `id` | A unique message ID for the event. Use this for deduplication or correlation. | | `type` | The event name in `{app}.{resource}.{event}` form, for example, `grafana_irm_app.incident.updated`. | | `source` | The producing app and instance, for example, `grafana_irm_app/100`. | | `time` | The event timestamp in RFC 3339 format. | | `data` | The body of the event. Available in workflows as `inputs.data.*`. | The contents of `data` depend on the event type. The remaining sections describe the supported event types. ## Incident events Trigger pattern: `grafana_irm_app.incident.updated`. JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "id": "msg-1", "type": "grafana_irm_app.incident.updated", "source": "grafana_irm_app/100", "time": "2026-04-22T12:00:00Z", "data": { "incidentID": "INC-123", "eventKind": "incident_updated_severity", "orgID": "100" } } ``` The `data` object includes the following fields: Expand table | Field | Type | Description | |--------------|--------|-----------------------------------------------------------------------------| | `incidentID` | string | The incident identifier. Use this to fetch the full incident or page on it. | | `eventKind` | string | The kind of update, for example, `incident_updated_severity`. | | `orgID` | string | The Grafana Cloud organization ID that produced the event. | When a workflow triggers on an incident event, the engine automatically loads the full incident and exposes it as `resources.incident.event`. For details and the available incident fields, refer to [Load incident data](/docs/grafana-cloud/alerting-and-irm/workflows/load-incident-data). ### Key update events When someone posts or edits a key update on an incident, the event arrives with the same trigger pattern, `grafana_irm_app.incident.updated`. Use the `eventKind` field to tell key update events apart from other incident updates: - `incident_added_key_update` fires when a new key update is posted. - `incident_updated_key_update` fires when an existing key update is edited. JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "id": "msg-1", "type": "grafana_irm_app.incident.updated", "source": "grafana_irm_app/100", "time": "2026-05-12T14:20:00Z", "data": { "incidentID": "INC-123", "eventKind": "incident_added_key_update", "orgID": "100", "keyUpdateID": "019f8583-a717-771b-9f98-e84e17c6cfd9", "title": "", "content": "Primary database restored. Monitoring for recurrence.", "newStatus": "Resolved", "previousStatus": "Active", "newSeverity": "Critical" } } ``` In addition to the standard incident event fields, the `data` object includes the following fields: Expand table | Field | Type | Description | |--------------------|--------|----------------------------------------------------------------------------------------| | `keyUpdateID` | string | The identifier of the key update that was posted or edited. | | `title` | string | The key update title. Empty when the key update has no title. | | `content` | string | The key update body, rendered as Markdown. | | `newStatus` | string | The incident status recorded on the key update, for example, `Resolved`. | | `previousStatus` | string | The previous incident status. Present only when the key update changed the status. | | `newSeverity` | string | The incident severity recorded on the key update, for example, `Critical`. | | `previousSeverity` | string | The previous incident severity. Present only when the key update changed the severity. | To trigger a workflow only on key update events, add a condition on `eventKind`: text ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```text inputs.data.eventKind == 'incident_added_key_update' ``` ### Reference incident event fields text ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```text inputs.data.incidentID inputs.data.eventKind resources.incident.event.title resources.incident.event.severity resources.incident.event.status ``` ## Alert group events Trigger pattern: `grafana_irm_app.alertgroup.updated`. JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "id": "msg-1", "type": "grafana_irm_app.alertgroup.updated", "source": "grafana_irm_app/11012", "time": "2026-04-23T02:57:15Z", "data": { "alertGroupID": "IXXDXP5KHEGRY", "orgID": "11012", "eventKind": "resolved", "alertGroup": { "id": "IXXDXP5KHEGRY", "state": "resolved" } } } ``` The `data` object includes the following fields: Expand table | Field | Type | Description | |----------------|--------|-----------------------------------------------------------------------------------| | `alertGroupID` | string | The alert group identifier. Use this to fetch the full alert group or page on it. | | `eventKind` | string | The kind of update, for example, `resolved` or `acknowledged`. | | `orgID` | string | The Grafana Cloud organization ID that produced the event. | | `alertGroup` | object | A subset of the alert group’s current state, including `id` and `state`. | When a workflow triggers on an alert group event, the engine automatically loads the alert group and exposes it as `resources.alertgroup.event`. For details and the available alert group fields, refer to [Load alert group data](/docs/grafana-cloud/alerting-and-irm/workflows/load-alert-group-data). ### Reference alert group event fields text ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```text inputs.data.alertGroupID inputs.data.eventKind inputs.data.alertGroup.state resources.alertgroup.event.title ``` ## Schedule events Trigger pattern: `grafana_irm_app.schedule.updated`. JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "id": "msg-1", "type": "grafana_irm_app.schedule.updated", "source": "grafana_irm_app/100", "time": "2026-04-22T12:00:00Z", "data": { } } ``` The schedule event fires when the current on-call users change. The exact `data` fields produced by this event are not yet documented for private preview customers. To work with the current on-call users in a workflow, use the [`irm.schedule-current-oncall`](/docs/grafana-cloud/alerting-and-irm/workflows/reference/#get-on-call-users-for-a-schedule-irm-schedule-current-oncall) step to look them up by schedule ID, regardless of which schedule fired the event. ## Manual triggers When you click **Run** in the editor, the **Trigger Workflow** dialog prefills a manual event in the same envelope shape: JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "id": "example-message-id", "type": "grafana-workflows..run.manual", "source": "grafana-workflows/", "time": "", "data": { } } ``` You edit the `data` object to match the shape of the event you want to simulate, for example, an incident event payload from this page. For details on manual triggers, refer to [Configure triggers](/docs/grafana-cloud/alerting-and-irm/workflows/configure-triggers/#trigger-workflows-manually). ## Next steps - [Configure triggers](/docs/grafana-cloud/alerting-and-irm/workflows/configure-triggers) - [Use CEL expressions](/docs/grafana-cloud/alerting-and-irm/workflows/use-expressions) - [Load incident data](/docs/grafana-cloud/alerting-and-irm/workflows/load-incident-data) - [Load alert group data](/docs/grafana-cloud/alerting-and-irm/workflows/load-alert-group-data)