On-call settings

Settings of a service under Services > (service) > On-call settings. Owners and admins change them; members see them. Every change is recorded in the audit log (event “Service changed”).

Settings

Production changes outside the code are never configurable: kanman always asks a person.

Severities

Each alerting tool’s levels are mapped to kanman’s five severities:

Generic alert format

Send POST requests with a JSON body to the source’s webhook URL. One alert, or several under alerts:

{
  "fingerprint": "checkout-5xx",
  "status": "firing",
  "severity": "critical",
  "title": "Checkout returns 500",
  "description": "Error rate above 5% for 5 minutes",
  "service": "checkout",
  "environment": "production",
  "startedAt": "2026-10-01T10:00:00Z",
  "labels": { "region": "eu" },
  "links": [{ "label": "Runbook", "url": "https://runbooks.example.com/checkout" }]
}

Signature

Sign the exact request body with the source’s secret, HMAC-SHA256, hex encoded:

X-Kanman-Signature: sha256=<hex HMAC-SHA256 of the body>

To protect against replays, add X-Kanman-Timestamp: <unix seconds> and sign <timestamp>.<body> instead; kanman then refuses requests older than five minutes.

Example with curl and openssl:

BODY='{"fingerprint":"checkout-5xx","status":"firing","severity":"critical","title":"Checkout returns 500"}'
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$KANMAN_SOURCE_SECRET" -hex | sed 's/^.* //')
curl -X POST "https://api.kanman.ai/functions/v1/signal-webhook/<source token>" \
  -H "Content-Type: application/json" -H "X-Kanman-Signature: sha256=$SIG" -d "$BODY"

How kanman checks webhooks

Requests without the right proof are refused with status 401; unknown addresses with 404. Accepted requests are answered with 202. Payloads larger than 512 KB are refused.

Audit events

See Audit export format.