Datadog integration

Forward Datadog monitor notifications to Unit Oncall as alerts. Datadog posts a JSON body to a webhook URL you configure, and Unit Oncall normalizes that payload, routes it to the right Schedule, and pages the on-call responder.

Setup

In Unit Oncall, create a Webhook (Integrations → Webhooks → New). Pick an existing Team and default Schedule. Standard auth mode is the simpler choice — the secret is embedded in the URL, so no header setup is needed — but Secure mode also works because Datadog webhook integrations support custom HTTP headers. Copy the generated Webhook URL.
In Datadog, open Integrations → Webhooks and add a new webhook.
Set the URL to the Unit Oncall Webhook URL from step 1.

Set the Payload to the JSON template Datadog should send. A minimal template that works with the recommended transformation rule below:

{
  "id": "$ID",
  "title": "$EVENT_TITLE",
  "alert_type": "$ALERT_TYPE",
  "body": "$EVENT_MSG",
  "last_updated": "$LAST_UPDATED",
  "tags": "$TAGS"
}

Reference the webhook from your monitor's notification message with @webhook-<name>.

Webhook URL

Unit Oncall exposes a single unified receive endpoint. The token in the path identifies the webhook (and, in Standard mode, carries the secret), so there is no separate Authorization header to set:

POST https://<your-api-host>/api/v1/wh/{token}

{token} is an opaque, encrypted value generated when you create the Webhook. Treat it as a credential and do not share it publicly.
Standard auth mode: the secret is embedded in the token, so the URL is self-contained. The simpler choice when you do not want to configure headers.
Secure auth mode: the secret is sent as the X-Webhook-Secret header or a webhook_secret body field. Datadog webhook integrations support custom HTTP headers, so Secure mode is also viable.

Recommended transformation rule

This rule maps the Datadog payload to Unit Oncall's normalized alert. It uses $.id as a stable fingerprint, formats a readable title, translates Datadog's alert_type into Unit Oncall severities, and maps last_updated as the detection time so state transitions are ordered correctly.

{
  "name": "Datadog monitors",
  "description": "Maps Datadog monitor webhook payloads to Unit Oncall alerts.",
  "is_active": true,
  "mappings": {
    "fingerprint": {
      "type": "jsonpath",
      "path": "$.id"
    },
    "title": {
      "type": "format",
      "format": "[{$.alert_type}] {$.title}"
    },
    "severity": {
      "type": "jsonpath",
      "path": "$.alert_type",
      "mapping": {
        "error": "critical",
        "warning": "warning",
        "success": "info",
        "info": "info"
      },
      "default": "warning"
    },
    "message": {
      "type": "jsonpath",
      "path": "$.body",
      "default": "Datadog monitor alert (no message body provided)"
    },
    "timestamp": {
      "type": "jsonpath",
      "path": "$.last_updated"
    },
    "tags": {
      "type": "jsonpath",
      "path": "$.tags"
    }
  }
}

See the Transformation Rule reference for the full field and mapping syntax.

Troubleshooting

No alert arrives. Use Datadog's Test button on the webhook, then check that the Webhook is enabled in Unit Oncall and that the URL was copied in full (the token must not be truncated).
403 webhook disabled. The Webhook exists but is_enabled is false. Enable it.
400 bad request. The token is malformed or the secret does not match. Regenerate or re-copy the Webhook URL.
Severity is always the default. Datadog sent an alert_type value that is not in the mapping table. Add the missing value (for example no data) to the severity mapping, or rely on default.
Alerts resolve/re-open out of order. Confirm last_updated is present in the Datadog payload template so timestamp resolves; otherwise Unit Oncall falls back to the receive time. See the note in the Transformation Rule reference.