Browse the sections below or use the quick navigation chips.
IncidentPulse is an internal and public incident management platform that helps teams log outages, coordinate responders, and communicate status transparently. It replaces spreadsheets and siloed tools with a single system of record for incidents, teams, and customer-facing updates.
Fragmented tooling slows response and frustrates customers. IncidentPulse centralizes detection, response, and communication so every stakeholder sees the same truth.
Designed for Admins, Operators, and Public stakeholders who need accountability and transparency.
Admin
Platform owners orchestrating policy, integrations, and governance.
Operator
On-call responders executing playbooks and communicating progress.
Public
Customers, partners, or executives monitoring health and uptime.
Each incident moves through a connected lifecycle so no context is lost between teams.
Alerts and monitors create an incident with auto severity.
Operators assign roles, run playbooks, and capture updates.
Stakeholders receive timeline posts, email, and status page updates.
Admins review analytics, publish postmortems, and refine SLAs.
Map responsibilities to clear permissions so the right people can act quickly without risking governance.
Configures the platform, enforces governance, and provides leadership with holistic visibility.
Frontline responders who run playbooks, collaborate in the timeline, and keep stakeholders informed.
Stakeholders, customers, or partners who consume the read-only status page and historical reports.
| Capability | Admin | Operator | Public |
|---|---|---|---|
| Create / triage incidents | Full | Full | No |
| Edit SLAs & playbooks | Full | Suggest | No |
| Publish status updates | Full | Full | Read |
| Manage team members | Full | No | No |
| View analytics & MTTR | Full | Full | Summary |
| Configure integrations | Full | Request | No |
| Brand public status site | Full | Request | No |
Each capability pairs a polished UI with deep operational workflows so you can launch quickly and scale with confidence.
Unify alert intake, manual reports, and automation triggers into a single prioritized queue.
Keep stakeholders aligned with templated updates across email, Slack, and public channels.
Model each customer-facing surface—website, APIs, data stores—and monitor them independently.
Clarify ownership by assigning incident commanders, communications leads, and subject experts.
Monitor MTTR, detection time, and customer impact with ready-to-share analytics dashboards.
Give responders a single place to upload screenshots, HAR files, or log bundles alongside each timeline update.
Deliver a trustworthy, branded status experience that reflects the latest internal truth.
Govern identity providers, integrations, webhooks, and audit trails from a single control center.
IncidentPulse separates marketing, operator, and public surfaces while sharing a secure core API and database.
Next.js marketing site and authenticated dashboard deployed on Vercel with React Server Components for performance.
Node/Express service hosted on Render exposes REST endpoints, handles auth, and orchestrates incident workflows.
PostgreSQL managed by Prisma migrations stores incidents, updates, user roles, and SLA policies with auditing.
Static, cache-friendly status site hydrated via incremental revalidation so customers always see accurate data.
A streamlined developer experience keeps onboarding fast whether you are evaluating locally or deploying to the cloud.
Follow these steps to stay productive.
Follow these steps to stay productive.
Follow these steps to stay productive.
Use an org-scoped API key and send a small JSON payload to /webhooks/incidents. Your monitoring/logging tools can forward events without code changes.
[OUTPUT]
Name http
Match *
Host your-api.com
URI /webhooks/incidents
Header Authorization Bearer ipk_xxxxxx
Format json
Json_date_key timestamp
[FILTER]
Name modify
Match *
Add service checkout
Add severity erroroutput.http:
hosts: ["https://your-api.com/webhooks/incidents"]
headers:
Authorization: "Bearer ipk_xxxxxx"
format: json
processors:
- add_fields:
target: ""
fields:
service: checkout
severity: errorDatadog webhook
- URL: https://your-api.com/webhooks/incidents
- Headers: Authorization: Bearer ipk_xxxxxx, Content-Type: application/json
- Payload template:
{
"service": "{{#is_alert}}checkout{{/is_alert}}",
"severity": "{{alert_status}}",
"message": "{{alert_title}} - {{alert_transition}}",
"timestamp": "{{last_updated}}"
}CloudWatch / EventBridge API destination
- Method: POST
- URL: https://your-api.com/webhooks/incidents
- Headers: Authorization: Bearer ipk_xxxxxx
- Body:
{
"service": "checkout",
"severity": "high",
"message": "Alarm {{alarmName}} state is {{newStateValue}}: {{newStateReason}}",
"timestamp": "{{timestamp}}"
}Loki / Alertmanager receiver
receivers:
- name: incidentpulse
webhook_configs:
- url: https://your-api.com/webhooks/incidents
http_config:
headers:
Authorization: Bearer ipk_xxxxxx
send_resolved: true[INPUT]
Name tail
Path /var/log/app.log
Tag app
Refresh_Interval 5
Skip_Long_Lines On
[FILTER]
Name modify
Match app
Add service checkout
Add level error
[OUTPUT]
Name http
Match app
Host your-api.com
URI /logs/ingest
Header Authorization Bearer ipk_xxxxxx
Format json
Json_date_key timestampfilebeat.inputs:
- type: filestream
id: app-logs
paths:
- /var/log/app.log
fields:
service: checkout
level: error
output.http:
hosts: ["https://your-api.com/logs/ingest"]
headers:
Authorization: "Bearer ipk_xxxxxx"
format: jsoncurl -X POST https://your-api.com/webhooks/incidents \
-H "Authorization: Bearer ipk_xxxxxx" \
-H "Content-Type: application/json" \
-d '{"service":"checkout","severity":"error","message":"DB timeout","timestamp":"2025-01-10T12:00:00Z"}'Required fields: service, severity, message. Optional: timestamp, context. Use a valid org API key in the Authorization: Bearer ... header. For raw logs, send level and message to /logs/ingest with the same API key header.
Connect monitoring platforms, scheduled jobs, or custom scripts to IncidentPulse. Alerts create or update incidents automatically, while recovery events close them and notify the assigned operator.
X-Signature (HMAC-SHA256 using WEBHOOK_HMAC_SECRET). Trusted internal tools can fall back to X-Webhook-Token.X-Idempotency-Key, a 60 requests/minute rate limit per token, and a ±10 minute skew window onoccurredAt keeps integrations reliable.Authenticate with API keys
Create an org-scoped key in Dashboard ? API Keys. Include it on every automation or webhook request:
POST https://your-backend.com/webhooks/incidents
Authorization: Bearer ipk_xxxxxx
Content-Type: application/jsonRotate by deleting the old key and issuing a new one.
WEBHOOK_HMAC_SECRET – required hex string used when calculating HMAC signatures. Generate it once (for exampleopenssl rand -hex 32), store it in Render → Environment, and distribute it to downstream tools via your secrets manager — it is not displayed in the dashboard.WEBHOOK_SHARED_TOKEN – optional bearer token for services that cannot sign requests.WEBHOOK_SYSTEM_USER_ID – optional UUID of the automation account that should author webhook incidents.GET /metrics/webhook (requires admin authentication).Treat the HMAC secret like any other credential: rotate it from Render if compromised and share it with integrators through a secure channel (password vault, secret manager). Open the dashboard’s Webhooks & Integrations tab to copy the alert and recovery endpoints, grab ready-to-run cURL/Postman snippets, and wire up Slack, Discord, Teams, or Telegram notifications. The panel reiterates which secrets live in Render but intentionally never exposes the raw values to prevent leakage.
POST /webhooks/incidents
Content-Type: application/json
X-Signature: <hex-hmac-from-WEBHOOK_HMAC_SECRET>
{
"service": "checkout-api",
"environment": "production",
"eventType": "error_spike",
"message": "500 errors exceeded 5% in the last 2 minutes",
"severity": "high",
"occurredAt": "2024-11-05T22:55:00Z",
"fingerprint": "checkout-api|production|error_spike",
"meta": {
"errorCount": 324,
"threshold": "5%"
}
}POST /webhooks/incidents/recovery
Content-Type: application/json
X-Signature: <hex-hmac-from-WEBHOOK_HMAC_SECRET>
{
"fingerprint": "checkout-api|production|error_spike",
"occurredAt": "2024-11-05T23:05:00Z",
"meta": {
"note": "Service restored automatically"
}
}- name: Notify IncidentPulse when workflow fails
if: failure()
env:
INCIDENT_URL: ${{ secrets.INCIDENTPULSE_ALERT_URL }}
INCIDENT_SECRET: ${{ secrets.INCIDENTPULSE_HMAC }}
run: |
payload=$(cat <<'JSON'
{
"service": "ci-pipeline",
"environment": "${{ github.ref_name }}",
"eventType": "workflow_failure",
"message": "Workflow ${{ github.workflow }} failed on ${{ github.sha }}",
"severity": "high",
"occurredAt": "${{ github.event.head_commit.timestamp }}",
"fingerprint": "ci|${{ github.repository }}|${{ github.workflow }}"
}
JSON
)
signature=$(echo -n "$payload" | openssl dgst -sha256 -hmac "$INCIDENT_SECRET" | sed 's/^.* //')
curl -sSf -X POST "$INCIDENT_URL" \
-H "Content-Type: application/json" \
-H "X-Signature: $signature" \
--data "$payload"{
"service": "edge-api",
"environment": "production",
"eventType": "uptimerobot_{{ALERT_TYPE}}",
"message": "Monitor {{MONITOR_NAME}} reported {{ALERT_TYPE}}",
"severity": "high",
"fingerprint": "uptimerobot|{{MONITOR_ID}}",
"occurredAt": "{{ALERT_TIME_ISO}}",
"meta": {
"monitorUrl": "{{URL}}",
"friendlyStatus": "{{ALERT_TYPE}}"
}
}Generate a key in Dashboard › API Keys, then pass Authorization: Bearer ipk_xxxxxx on every API or webhook call. Here are quick starts in popular languages:
import fetch from "node-fetch";
const apiKey = "ipk_xxxxxx";
async function sendAlert() {
const res = await fetch("https://your-backend.com/webhooks/incidents", {
method: "POST",
headers: {
"Authorization": `Bearer ${apiKey}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
service: "checkout",
severity: "high",
message: "Error rate exceeded 5%"
})
});
if (!res.ok) throw new Error(`Failed: ${res.status}`);
}
sendAlert();import requests
api_key = "ipk_xxxxxx"
url = "https://your-backend.com/webhooks/incidents"
payload = {
"service": "checkout",
"severity": "high",
"message": "Error rate exceeded 5%"
}
resp = requests.post(
url,
headers={
"Authorization": f"Bearer {api_key}",
"Content-Type": "application/json",
},
json=payload,
timeout=10,
)
resp.raise_for_status()package main
import (
"bytes"
"encoding/json"
"net/http"
)
func main() {
body, _ := json.Marshal(map[string]string{
"service": "checkout",
"severity": "high",
"message": "Error rate exceeded 5%",
})
req, _ := http.NewRequest("POST", "https://your-backend.com/webhooks/incidents", bytes.NewBuffer(body))
req.Header.Set("Authorization", "Bearer ipk_xxxxxx")
req.Header.Set("Content-Type", "application/json")
http.DefaultClient.Do(req)
}$apiKey = "ipk_xxxxxx";
$url = "https://your-backend.com/webhooks/incidents";
$payload = [
"service" => "checkout",
"severity" => "high",
"message" => "Error rate exceeded 5%",
];
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => [
"Authorization: Bearer $apiKey",
"Content-Type: application/json",
],
CURLOPT_POSTFIELDS => json_encode($payload),
CURLOPT_RETURNTRANSFER => true,
]);
$resp = curl_exec($ch);
curl_close($ch);using var client = new HttpClient();
var req = new HttpRequestMessage(HttpMethod.Post, "https://your-backend.com/webhooks/incidents");
req.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", "ipk_xxxxxx");
req.Content = new StringContent("{\"service\":\"checkout\",\"severity\":\"high\",\"message\":\"Error rate exceeded 5%\"}", System.Text.Encoding.UTF8, "application/json");
var resp = await client.SendAsync(req);
resp.EnsureSuccessStatusCode();import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Main {
public static void main(String[] args) throws Exception {
var client = HttpClient.newHttpClient();
var body = """
{\"service\":\"checkout\",\"severity\":\"high\",\"message\":\"Error rate exceeded 5%\"}
""";
var req = HttpRequest.newBuilder()
.uri(URI.create("https://your-backend.com/webhooks/incidents"))
.header("Authorization", "Bearer ipk_xxxxxx")
.header("Content-Type", "application/json")
.POST(HttpRequest.BodyPublishers.ofString(body))
.build();
var resp = client.send(req, HttpResponse.BodyHandlers.ofString());
if (resp.statusCode() >= 400) throw new RuntimeException("Failed: " + resp.statusCode());
}
}use reqwest::Client;
use serde_json::json;
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
let client = Client::new();
let res = client
.post("https://your-backend.com/webhooks/incidents")
.bearer_auth("ipk_xxxxxx")
.json(&json!({
"service": "checkout",
"severity": "high",
"message": "Error rate exceeded 5%"
}))
.send()
.await?;
res.error_for_status()?;
Ok(())
}Sample JSON response
HTTP/1.1 200 OK
Content-Type: application/json
{
"error": false,
"message": "Webhook accepted",
"incidentId": "inc_12345",
"status": "investigating"
}fingerprint for ten minutes while the incident is open; higher severity replays automatically escalate.resolvedAt, and notify the assigned operator plus the incident timeline.Pair the API with React Query on the frontend or integrate with other systems for automation and reporting.
POST /auth/login
Content-Type: application/json
{
"email": "oncall@example.com",
"password": "super-secret"
}200 OK
Content-Type: application/json
{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"user": {
"id": "usr_123",
"name": "Riley SRE",
"role": "admin",
"team": "Site Reliability"
}
}GET /incidents?status=active&severity=high
Accept: application/json200 OK
Content-Type: application/json
{
"data": [
{
"id": "inc_481",
"title": "Checkout latency spike",
"severity": "high",
"state": "investigating",
"owner": "Alex Rivera",
"opened_at": "2025-11-02T16:21:00.000Z"
}
],
"meta": {
"page": 1,
"pageSize": 25,
"total": 74
}
}PATCH /incidents/inc_481
Content-Type: application/json
{
"state": "mitigated",
"assignee": "Jordan Lee",
"timeline": [
{
"type": "update",
"body": "Applied hotfix to rollback release 2025.11.02"
}
]
}200 OK
Content-Type: application/json
{
"id": "inc_481",
"state": "mitigated",
"resolved_at": "2025-11-02T17:05:00.000Z",
"timeline": [
{
"at": "2025-11-02T16:45:00.000Z",
"body": "Applied hotfix to rollback release 2025.11.02",
"author": "Jordan Lee"
}
]
}POST /incidents/inc_481/attachments
Content-Type: multipart/form-data
file: outage-dashboard.png201 Created
Content-Type: application/json
{
"error": false,
"data": {
"id": "att_901",
"filename": "outage-dashboard.png",
"mimeType": "image/png",
"size": 418204,
"url": "/uploads/incidents/inc_481/outage-dashboard.png"
}
}DELETE /incidents/inc_481/attachments/att_901204 No ContentPOST /maintenance
Content-Type: application/json
{
"title": "Database maintenance",
"description": "Upgrading storage tier. Read-only for 15 minutes.",
"startsAt": "2025-11-10T01:00:00Z",
"endsAt": "2025-11-10T01:15:00Z",
"appliesToAll": false,
"serviceId": "svc_db_primary"
}201 Created
Content-Type: application/json
{
"error": false,
"data": {
"id": "mnt_901",
"status": "scheduled",
"startsAt": "2025-11-10T01:00:00.000Z",
"endsAt": "2025-11-10T01:15:00.000Z",
"appliesToAll": false,
"service": {
"id": "svc_db_primary",
"name": "Primary Database"
}
}
}GET /maintenance?window=upcoming
Accept: application/json200 OK
Content-Type: application/json
{
"data": [
{
"id": "mnt_901",
"title": "Database maintenance",
"status": "scheduled",
"startsAt": "2025-11-10T01:00:00.000Z",
"endsAt": "2025-11-10T01:15:00.000Z",
"appliesToAll": false,
"service": {
"id": "svc_db_primary",
"name": "Primary Database"
}
}
]
}Guide operators and admins through frequent blockers to keep the platform running smoothly.
Operators only see incidents tied to their services or assignments. Ask an Admin to extend your service scope or grant temporary all-incident access when needed.
The public page only shows incidents marked as customer-impacting or scheduled maintenance. Confirm incidents have published updates and that cache invalidation has completed.
The backend streams files into the directory referenced by UPLOAD_DIR (uploads/ by default, relative to the backend app) and serves them via the /uploads prefix. Point UPLOAD_DIR at persistent storage so artifacts survive restarts.
Admins can connect Slack, Discord, Microsoft Teams, or Telegram under System Settings → Integrations. Paste the webhook URL or bot credentials, choose the destination channel, and IncidentPulse will publish incident creation, assignment, and resolution events automatically.
Yes. Import CSV data or use the bulk API to seed legacy incidents. Run "npm run seed" in the backend to load sample data for demos.
Developed by the IncidentPulse team for demonstration and portfolio scenarios. Contributions, bug reports, and feature requests are welcome.