Documentation Grafana Cloud Platform Workflows Step and trigger types reference Event payloads

Sample event payloads

Workflows receive events in CloudEvents shape. Use this page to understand the payload your workflows match against and to write CEL expressions that read fields from the triggering event.

Event envelope

Every event delivered to a workflow has the same top-level shape:

JSON Copy

{
  "id": "<MESSAGE_ID>",
  "type": "<APP>.<STACK_ID>.<RESOURCE>.<EVENT>",
  "source": "<APP>/<STACK_ID>",
  "time": "<RFC_3339_TIMESTAMP>",
  "data": { }
}

Matching rules compare against the event name without the stack ID, for example, grafana_irm_app.incident.updated. The contents of data depend on the event type. The remaining sections describe the supported event types.

Incident events

Trigger pattern: grafana_irm_app.incident.updated.

Every incident event has the same base fields in data, plus extra fields that depend on the kind of change. Events aren’t sent for private incidents.

JSON Copy

{
  "id": "6f1c2a9e-3b7d-4c51-9e8a-2d4b6f0a1c37",
  "type": "grafana_irm_app.100.incident.updated",
  "source": "grafana_irm_app/100",
  "time": "2026-05-10T08:15:04Z",
  "data": {
    "incidentID": "54",
    "userID": "grafana-incident:user-2",
    "orgID": "100",
    "eventKind": "incident_created",
    "slackChannelID": "",
    "title": "Checkout API returning 500s",
    "status": "active",
    "statusID": "0b6f2d1e-7c4a-4f39-8e21-5a9d3c7b1e60",
    "severityID": "c3e8a1f4-2b6d-4e97-a051-7f9b2d4c6e18",
    "description": "Customers can't complete checkout."
  }
}

The base fields are:

The event doesn’t include the incident itself. When a workflow triggers on an incident event, Workflows loads the full incident as resources.incident.event. For details and the available incident fields, refer to Load incident data.

Incident event kinds

Each eventKind adds these fields to data:

newStatus and previousStatus are status categories on status events, but status names, such as Resolved, on key update events.

Resolving an incident can send two incident_updated_status events with the same closedTime. If a workflow should act once per resolution, set runOnceFor to a key that includes the incident ID and closedTime.

Key update events

When someone posts or edits a key update on an incident, the event includes the update itself:

JSON Copy

{
  "id": "d7f2b8c4-6e1a-4d39-8b52-0a9e4c6f3d71",
  "type": "grafana_irm_app.100.incident.updated",
  "source": "grafana_irm_app/100",
  "time": "2026-05-10T09:41:55Z",
  "data": {
    "incidentID": "54",
    "userID": "grafana-incident:user-2",
    "orgID": "100",
    "eventKind": "incident_added_key_update",
    "slackChannelID": "C0123456789",
    "keyUpdateID": "019f8583-a717-771b-9f98-e84e17c6cfd9",
    "title": "",
    "content": "Rolled back the payments deploy. Error rate is back to normal.",
    "newStatus": "Resolved",
    "previousStatus": "Active",
    "newSeverity": "Critical"
  }
}

To trigger a workflow only on new key updates, add a condition on eventKind:

text Copy

inputs.data.eventKind == 'incident_added_key_update'

Reference incident event fields

Use these paths in CEL expressions:

text Copy

inputs.data.incidentID
inputs.data.eventKind
resources.incident.event.title
resources.incident.event.severity
resources.incident.event.status

Alert group events

Trigger pattern: grafana_irm_app.alertgroup.updated.

JSON Copy

{
  "id": "8c3f1a7e-2d9b-4e65-a8f0-4b1e7c9d3a52",
  "type": "grafana_irm_app.11012.alertgroup.updated",
  "source": "grafana_irm_app/11012",
  "time": "2026-04-23T02:57:16Z",
  "data": {
    "alertGroupID": "IXXDXP5KHEGRY",
    "orgID": "11012",
    "eventKind": "created",
    "alertGroup": {
      "id": "IXXDXP5KHEGRY",
      "integration_id": "CRK2G7WQ4NFJH",
      "team_id": "TD8Y3M6L1QVBA",
      "state": "firing",
      "created_at": "2026-04-23T02:57:15.482193+00:00",
      "title": "High error rate on checkout-api",
      "labels": [
        { "key": { "name": "severity" }, "value": { "name": "critical" } },
        { "key": { "name": "service" }, "value": { "name": "checkout-api" } }
      ]
    }
  }
}

The data object includes the following fields:

eventKind is one of created, acknowledged, unacknowledged, resolved, unresolved, silenced, unsilenced, resolution_note_added, label_added, or label_removed. A created event fires once, when the alert group is first created. Label events fire when someone adds or removes a label in the UI or the API, not for labels set when the alert arrives.

The alertGroup object includes these fields:

The *_by fields are users with id, grafanaUserID, username, and email.

When a workflow triggers on an alert group event, Workflows also loads the alert group from the Grafana IRM API as resources.alertgroup.event, which adds fields such as alerts_count and permalinks. For details, refer to Load alert group data.

Reference alert group event fields

Use these paths in CEL expressions:

text Copy

inputs.data.alertGroupID
inputs.data.eventKind
inputs.data.alertGroup.state
resources.alertgroup.event.title
resources.alertgroup.event.permalinks.web

Schedule events

Trigger pattern: grafana_irm_app.schedule.updated.

A schedule event fires when the set of people on call for a schedule changes. It fires for every schedule in your stack, so filter on inputs.data.schedule.name or inputs.data.scheduleID to react to one schedule.

JSON Copy

{
  "id": "c5a8e2f1-4b7d-4396-8e0c-2f9b6d3a7e14",
  "type": "grafana_irm_app.11012.schedule.updated",
  "source": "grafana_irm_app/11012",
  "time": "2026-04-27T09:00:12Z",
  "data": {
    "scheduleID": "SBM7KQ2X9PLDC",
    "orgID": "11012",
    "eventKind": "on_call_changed",
    "schedule": {
      "id": "SBM7KQ2X9PLDC",
      "name": "Payments primary",
      "team": { "id": "TD8Y3M6L1QVBA", "name": "Payments" }
    },
    "previousOnCall": [
      { "id": "UH4N8C2RT6KWZ", "grafanaUserID": 7, "username": "alice", "email": "alice@example.com" }
    ],
    "currentOnCall": [
      { "id": "UP9F3V7B2XJQM", "grafanaUserID": 12, "username": "bob", "email": "bob@example.com" }
    ],
    "usersAdded": [
      { "id": "UP9F3V7B2XJQM", "grafanaUserID": 12, "username": "bob", "email": "bob@example.com" }
    ],
    "usersRemoved": [
      { "id": "UH4N8C2RT6KWZ", "grafanaUserID": 7, "username": "alice", "email": "alice@example.com" }
    ]
  }
}

The data object includes the following fields:

Each user has id, grafanaUserID, username, and email. To get Slack IDs or shift times, use the Get on-call users from a schedule step with inputs.data.scheduleID.

Manual triggers

When you click Run in the editor, the Trigger Workflow dialog box opens with a sample event in Event Data (JSON). Edit it to match the event you want to test with, then click Trigger Workflow.

If the workflow triggers on an incident, alert group, or schedule event, the dialog box starts with a sample of that event. To try a different one, choose it from the Example Event list, for example, Incident declared or Alert group resolved. The samples use placeholder IDs. If your workflow loads the incident or alert group, replace the ID with a real one from your stack.

For any other workflow, the dialog box starts with an empty event in the same shape as the others. Workflows with sample events also offer it as Generic Template, the last option in the Example Event list:

JSON Copy

{
  "id": "example-message-id",
  "type": "grafana-workflows.<ORG_ID>.run.manual",
  "source": "grafana-workflows/<ORG_ID>",
  "time": "<CURRENT_TIME>",
  "data": { }
}

Fill in the data object with the fields your workflow reads, for example, the fields from an incident event on this page.

For details on manual triggers, refer to Configure triggers.

Next steps

• Configure triggers
• Use CEL expressions
• Load incident data
• Load alert group data