--- title: "Sample event payloads | Grafana Cloud documentation" description: "Reference samples of the CloudEvents-shaped payloads delivered to Grafana Workflows for incident, alert group, and schedule events." --- > For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt). # Sample event payloads > Note > > Grafana Workflows is currently in [public preview](/docs/release-life-cycle/). Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available. Workflows receive events in [CloudEvents](https://cloudevents.io/) shape. Use this page to understand the payload your workflows match against and to write CEL expressions that read fields from the triggering event. ## Event envelope Every event delivered to a workflow has the same top-level shape: JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "id": "", "type": "...", "source": "/", "time": "", "data": { } } ``` Expand table | Field | Description | |----------|-------------------------------------------------------------------------------------------------------------------| | `id` | A unique ID for each delivery. A retried delivery gets a new ID, so use a field in `data` to deduplicate instead. | | `type` | The full event name, including your stack ID, for example, `grafana_irm_app.100.incident.updated`. | | `source` | The producing app and stack, for example, `grafana_irm_app/100`. | | `time` | When the event was sent, in RFC 3339 format. | | `data` | The body of the event. Available in workflows as `inputs.data.*`. | Matching rules compare against the event name without the stack ID, for example, `grafana_irm_app.incident.updated`. The contents of `data` depend on the event type. The remaining sections describe the supported event types. ## Incident events Trigger pattern: `grafana_irm_app.incident.updated`. Every incident event has the same base fields in `data`, plus extra fields that depend on the kind of change. Events aren’t sent for private incidents. JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "id": "6f1c2a9e-3b7d-4c51-9e8a-2d4b6f0a1c37", "type": "grafana_irm_app.100.incident.updated", "source": "grafana_irm_app/100", "time": "2026-05-10T08:15:04Z", "data": { "incidentID": "54", "userID": "grafana-incident:user-2", "orgID": "100", "eventKind": "incident_created", "slackChannelID": "", "title": "Checkout API returning 500s", "status": "active", "statusID": "0b6f2d1e-7c4a-4f39-8e21-5a9d3c7b1e60", "severityID": "c3e8a1f4-2b6d-4e97-a051-7f9b2d4c6e18", "description": "Customers can't complete checkout." } } ``` The base fields are: Expand table | Field | Type | Description | |------------------|--------|--------------------------------------------------------------------------------------------| | `incidentID` | string | The incident ID, for example, `54`. | | `userID` | string | The user who made the change. For role changes, this is the user who got or lost the role. | | `orgID` | string | Your stack ID. | | `eventKind` | string | The kind of change. The following table lists every value. | | `slackChannelID` | string | The incident’s Slack channel ID, or an empty string when the incident has no channel. | The event doesn’t include the incident itself. When a workflow triggers on an incident event, Workflows loads the full incident as `resources.incident.event`. For details and the available incident fields, refer to [Load incident data](/docs/grafana-cloud/platform/workflows/load-incident-data). ### Incident event kinds Each `eventKind` adds these fields to `data`: Expand table | `eventKind` | Extra fields | |--------------------------------|-----------------------------------------------------------------------------------------------------------------------------| | `incident_created` | `title`, `status` (`active`), `statusID`, `severityID`, `description` | | `incident_renamed` | `title`, `oldTitle`, `oldSlug` | | `incident_assigned_role` | `role`, for example, `commander` | | `incident_unassigned_role` | `role` | | `incident_updated_status` | `newStatus`, `previousStatus` (`active` or `resolved`), `statusID`, `previousStatusID`, `closedTime` | | `incident_updated_severity` | `newSeverity`, `oldSeverity`, as display labels, for example, `Critical` and `Pending` | | `incident_updated_description` | None. Read the new description from `resources.incident.event`. | | `incident_updated_is_drill` | `isDrill` | | `incident_updated_event_time` | `eventName`, `cleared`, and `eventTime` when it isn’t cleared | | `incident_added_label` | `key`, `label`, for example, `team` and `payments` | | `incident_removed_label` | `key`, `label` | | `incident_updated_field_value` | `slug`, `newValue`, `previousValue`, as display values | | `incident_added_key_update` | `keyUpdateID`, `title`, `content`, `newStatus`, `newSeverity`, and `previousStatus` or `previousSeverity` when they changed | | `incident_updated_key_update` | The same fields as `incident_added_key_update` | `newStatus` and `previousStatus` are status categories on status events, but status names, such as `Resolved`, on key update events. Resolving an incident can send two `incident_updated_status` events with the same `closedTime`. If a workflow should act once per resolution, set `runOnceFor` to a key that includes the incident ID and `closedTime`. ### Key update events When someone posts or edits a key update on an incident, the event includes the update itself: JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "id": "d7f2b8c4-6e1a-4d39-8b52-0a9e4c6f3d71", "type": "grafana_irm_app.100.incident.updated", "source": "grafana_irm_app/100", "time": "2026-05-10T09:41:55Z", "data": { "incidentID": "54", "userID": "grafana-incident:user-2", "orgID": "100", "eventKind": "incident_added_key_update", "slackChannelID": "C0123456789", "keyUpdateID": "019f8583-a717-771b-9f98-e84e17c6cfd9", "title": "", "content": "Rolled back the payments deploy. Error rate is back to normal.", "newStatus": "Resolved", "previousStatus": "Active", "newSeverity": "Critical" } } ``` To trigger a workflow only on new key updates, add a condition on `eventKind`: text ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```text inputs.data.eventKind == 'incident_added_key_update' ``` ### Reference incident event fields Use these paths in CEL expressions: text ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```text inputs.data.incidentID inputs.data.eventKind resources.incident.event.title resources.incident.event.severity resources.incident.event.status ``` ## Alert group events Trigger pattern: `grafana_irm_app.alertgroup.updated`. JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "id": "8c3f1a7e-2d9b-4e65-a8f0-4b1e7c9d3a52", "type": "grafana_irm_app.11012.alertgroup.updated", "source": "grafana_irm_app/11012", "time": "2026-04-23T02:57:16Z", "data": { "alertGroupID": "IXXDXP5KHEGRY", "orgID": "11012", "eventKind": "created", "alertGroup": { "id": "IXXDXP5KHEGRY", "integration_id": "CRK2G7WQ4NFJH", "team_id": "TD8Y3M6L1QVBA", "state": "firing", "created_at": "2026-04-23T02:57:15.482193+00:00", "title": "High error rate on checkout-api", "labels": [ { "key": { "name": "severity" }, "value": { "name": "critical" } }, { "key": { "name": "service" }, "value": { "name": "checkout-api" } } ] } } } ``` The `data` object includes the following fields: Expand table | Field | Type | Description | |------------------|--------|----------------------------------------------------------------------------------------------------------| | `alertGroupID` | string | The alert group identifier. | | `orgID` | string | Your stack ID. | | `eventKind` | string | The kind of change, for example, `created` or `resolved`. | | `userID` | string | The user who made the change. Not present on `created` events. | | `alertGroup` | object | The alert group’s current state. The following table describes its fields. | | `label` | object | The label that was added or removed, as `{key: {name}, value: {name}}`. Only on label events. | | `resolutionNote` | object | The note that was added, with `id`, `created_at`, `text`, and `author`. Only on `resolution_note_added`. | `eventKind` is one of `created`, `acknowledged`, `unacknowledged`, `resolved`, `unresolved`, `silenced`, `unsilenced`, `resolution_note_added`, `label_added`, or `label_removed`. A `created` event fires once, when the alert group is first created. Label events fire when someone adds or removes a label in the UI or the API, not for labels set when the alert arrives. The `alertGroup` object includes these fields: Expand table | Field | Description | |--------------------------------------|---------------------------------------------------------------------------| | `id` | The alert group identifier. | | `integration_id` | The integration that received the alert. | | `team_id` | The team that owns the integration, or `null`. | | `state` | One of `firing`, `acknowledged`, `resolved`, or `silenced`. | | `created_at` | When the alert group started. | | `title` | The alert group title. | | `labels` | The alert group’s labels, each as `{key: {name}, value: {name}}`. | | `acknowledged_at`, `acknowledged_by` | When and by whom it was acknowledged. Present only after acknowledgement. | | `resolved_at`, `resolved_by` | When and by whom it was resolved. Present only after resolution. | | `silenced_at` | When it was silenced. Present only while silenced. | The `*_by` fields are users with `id`, `grafanaUserID`, `username`, and `email`. When a workflow triggers on an alert group event, Workflows also loads the alert group from the Grafana IRM API as `resources.alertgroup.event`, which adds fields such as `alerts_count` and `permalinks`. For details, refer to [Load alert group data](/docs/grafana-cloud/platform/workflows/load-alert-group-data). ### Reference alert group event fields Use these paths in CEL expressions: text ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```text inputs.data.alertGroupID inputs.data.eventKind inputs.data.alertGroup.state resources.alertgroup.event.title resources.alertgroup.event.permalinks.web ``` ## Schedule events Trigger pattern: `grafana_irm_app.schedule.updated`. A schedule event fires when the set of people on call for a schedule changes. It fires for every schedule in your stack, so filter on `inputs.data.schedule.name` or `inputs.data.scheduleID` to react to one schedule. JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "id": "c5a8e2f1-4b7d-4396-8e0c-2f9b6d3a7e14", "type": "grafana_irm_app.11012.schedule.updated", "source": "grafana_irm_app/11012", "time": "2026-04-27T09:00:12Z", "data": { "scheduleID": "SBM7KQ2X9PLDC", "orgID": "11012", "eventKind": "on_call_changed", "schedule": { "id": "SBM7KQ2X9PLDC", "name": "Payments primary", "team": { "id": "TD8Y3M6L1QVBA", "name": "Payments" } }, "previousOnCall": [ { "id": "UH4N8C2RT6KWZ", "grafanaUserID": 7, "username": "alice", "email": "alice@example.com" } ], "currentOnCall": [ { "id": "UP9F3V7B2XJQM", "grafanaUserID": 12, "username": "bob", "email": "bob@example.com" } ], "usersAdded": [ { "id": "UP9F3V7B2XJQM", "grafanaUserID": 12, "username": "bob", "email": "bob@example.com" } ], "usersRemoved": [ { "id": "UH4N8C2RT6KWZ", "grafanaUserID": 7, "username": "alice", "email": "alice@example.com" } ] } } ``` The `data` object includes the following fields: Expand table | Field | Type | Description | |------------------|--------|------------------------------------------------------------------------------------| | `scheduleID` | string | The schedule identifier. | | `orgID` | string | Your stack ID. | | `eventKind` | string | Always `on_call_changed`. | | `schedule` | object | The schedule’s `id`, `name`, and `team`. `team` has `id` and `name`, or is `null`. | | `previousOnCall` | array | The users who were on call before the change. | | `currentOnCall` | array | The users on call now. | | `usersAdded` | array | The users who went on call. | | `usersRemoved` | array | The users who went off call. | Each user has `id`, `grafanaUserID`, `username`, and `email`. To get Slack IDs or shift times, use the [Get on-call users from a schedule](/docs/grafana-cloud/platform/workflows/reference/#get-on-call-users-from-a-schedule-irmschedule-current-oncall) step with `inputs.data.scheduleID`. ## Manual triggers When you click **Run** in the editor, the **Trigger Workflow** dialog box opens with a sample event in **Event Data (JSON)**. Edit it to match the event you want to test with, then click **Trigger Workflow**. If the workflow triggers on an incident, alert group, or schedule event, the dialog box starts with a sample of that event. To try a different one, choose it from the **Example Event** list, for example, **Incident declared** or **Alert group resolved**. The samples use placeholder IDs. If your workflow loads the incident or alert group, replace the ID with a real one from your stack. For any other workflow, the dialog box starts with an empty event in the same shape as the others. Workflows with sample events also offer it as **Generic Template**, the last option in the **Example Event** list: JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "id": "example-message-id", "type": "grafana-workflows..run.manual", "source": "grafana-workflows/", "time": "", "data": { } } ``` Fill in the `data` object with the fields your workflow reads, for example, the fields from an incident event on this page. > Note > > **Run** doesn’t load incident or alert group data from the sample event, and it doesn’t apply trigger filters. To test a workflow that uses that data, add the incident or alert group as a resource. For details, refer to [Test with incident data](/docs/grafana-cloud/platform/workflows/load-incident-data/#test-with-incident-data) and [Test with alert group data](/docs/grafana-cloud/platform/workflows/load-alert-group-data/#test-with-alert-group-data). For details on manual triggers, refer to [Configure triggers](/docs/grafana-cloud/platform/workflows/configure-triggers/#trigger-workflows-manually). ## Next steps - [Configure triggers](/docs/grafana-cloud/platform/workflows/configure-triggers) - [Use CEL expressions](/docs/grafana-cloud/platform/workflows/use-expressions) - [Load incident data](/docs/grafana-cloud/platform/workflows/load-incident-data) - [Load alert group data](/docs/grafana-cloud/platform/workflows/load-alert-group-data)