Roll an alert source's key. The old key stops working at once, and an email source gets a new address.
const url = 'https://api.siteqwality.com/v1/alert-sources/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/roll-key';const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.siteqwality.com/v1/alert-sources/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/roll-key \ --header 'Authorization: Bearer <token>'Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”Header Parameters
Section titled “Header Parameters ”Makes a retry safe, but the new secret is shown once and never stored: a retry with the same key and body is refused with 409 secret_not_replayable instead of running again.
Responses
Section titled “ Responses ”The source and its new key, shown once
A source with its key, returned once on create and roll.
object
Incidents open on this service.
Overrides the service’s escalation policy for incidents this source opens.
The key’s first characters, to tell keys apart.
Where an email source receives alerts. Rolling the key replaces it.
How an email source reads each email.
object
A subject that matches resolves its incident instead of opening one, for example ^(UP|RECOVERY|OK)\b.
Its first group, or the whole match, is the dedup key, so each thing it names gets its own incident: for
example (?:DOWN|UP): (.+). Left out, or with no match, all of the address’s emails share one incident.
Where a generic_json source finds each field.
object
The dedup key: events with the same one open, update and close one incident.
The status. Left out, every event triggers.
Status values that trigger, ignoring case. Empty takes trigger, triggered, firing, alert, alerting,
open, problem and down.
Status values that resolve. Empty takes resolve, resolved, ok, recovered, closed, up, normal and
cleared.
Status values that acknowledge. Empty takes acknowledge, acknowledged and ack.
The severity: critical, error, warning, info or a common synonym.
An http(s) link back to the alert.
With a signing secret set: the header holding the body’s HMAC-SHA256, in hex or base64, with or without
sha256=. Left out, X-Signature.
With a signing secret set: a header holding the Unix time the sender signed at. When named, the signature
covers <timestamp>.<body> and must be under 10 minutes old.
Whether a signing secret is set (sentry and generic_json). The secret itself is never returned.
While set, each event keeps its body, redacted, for debugging. Ends 24 hours after it was turned on.
The key: Events v2’s routing_key, or the bearer token for the other formats. Shown only now. An email
source does not use it.
Where to send events; for an email source, its address.
The URL with the key in it, for a sender that cannot set an Authorization header. Not for Events v2.
Example generated
{ "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "account_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "service_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "escalation_policy_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "name": "example", "format": "example", "key_prefix": "example", "email_address": "example", "email_rules": { "resolve_pattern": "example", "dedup_pattern": "example" }, "mapping": { "dedup_key": "example", "summary": "example", "status": "example", "trigger_values": [ "example" ], "resolve_values": [ "example" ], "acknowledge_values": [ "example" ], "severity": "example", "link": "example", "signature_header": "example", "timestamp_header": "example" }, "signing_secret_set": true, "debug_capture_until": "2026-04-15T12:00:00Z", "disabled_at": "2026-04-15T12:00:00Z", "last_event_at": "2026-04-15T12:00:00Z", "created_at": "2026-04-15T12:00:00Z", "key": "example", "url": "example", "url_with_key": "example"}Missing or invalid credentials
An RFC 9457 problem, the body of every /v1 error.
object
https://docs.siteqwality.com/errors/ and the failure’s code, such as not_found.
urn:uuid: and the request id.
The invalid fields, when the request body was refused.
One validation failure; pointer is an RFC 6901 pointer into the request body.
object
Example generated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "instance": "example", "errors": [ { "pointer": "example", "detail": "example" } ]}The key or member may not do this, or lacks the scope it needs
An RFC 9457 problem, the body of every /v1 error.
object
https://docs.siteqwality.com/errors/ and the failure’s code, such as not_found.
urn:uuid: and the request id.
The invalid fields, when the request body was refused.
One validation failure; pointer is an RFC 6901 pointer into the request body.
object
Example generated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "instance": "example", "errors": [ { "pointer": "example", "detail": "example" } ]}No such source in this account
An RFC 9457 problem, the body of every /v1 error.
object
https://docs.siteqwality.com/errors/ and the failure’s code, such as not_found.
urn:uuid: and the request id.
The invalid fields, when the request body was refused.
One validation failure; pointer is an RFC 6901 pointer into the request body.
object
Example generated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "instance": "example", "errors": [ { "pointer": "example", "detail": "example" } ]}Too many requests; wait for the time in Retry-After
An RFC 9457 problem, the body of every /v1 error.
object
https://docs.siteqwality.com/errors/ and the failure’s code, such as not_found.
urn:uuid: and the request id.
The invalid fields, when the request body was refused.
One validation failure; pointer is an RFC 6901 pointer into the request body.
object
Example generated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "instance": "example", "errors": [ { "pointer": "example", "detail": "example" } ]}