> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Certificate alerts in PagerDuty > Create PagerDuty incidents for certificate alerts. A PagerDuty channel on a certificate [alert](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview) creates PagerDuty incidents through the [Events API v2](https://developer.pagerduty.com/docs/events-api-v2-overview), so your on-call team gets paged when certificates are about to expire or are revoked. > [!NOTE] > > PagerDuty channels are available under Infisical's [Enterprise](https://infisical.com/pricing) plan. If you're self-hosting Infisical, contact [sales@infisical.com](mailto:sales@infisical.com) to purchase an enterprise license. ## Prerequisites * The Certificate Management **Admin** role to create an organization-wide alert, or the **Admin** [application role](https://infisical.com/docs/documentation/platform/pki/applications/overview.md#application-roles) to create an application alert * A PagerDuty account that can create services or add integrations to an existing service ## Step 1: Get a PagerDuty integration key **Step 1** In PagerDuty, go to **Services** > **Service Directory** and select **New Service**. **Step 2** Name the service, for example `Infisical PKI Alerts`, choose **Events API v2** as the integration, and select **Create Service**. > [!NOTE] > > To use an existing service, open the service and go to **Integrations** > **Add an Integration** > **Events API v2**. **Step 3** Copy the 32-character **Integration Key** from the service's **Integrations** tab. > [!NOTE] > > Anyone with the integration key can send events to your PagerDuty service, so store it like a secret. ## Step 2: Create the alert > [tab] Infisical UI > > **Step 1** > > Open the alert form: > > * For an organization-wide alert, go to **Certificate Manager** > **Settings**, select the **Alerts** tab, then select **Create Alert** > * For an application alert, go to **Certificate Manager** > **Applications** and select your application, then select the **Settings** tab and select **Create Alert** in the **Alerts** section > > **Step 2** > > Select the **Alert Type**, then enter an **Alert Name** and an optional **Description**. An application can have one alert for each event, so to notify more places about the same event, add more channels to that alert. > > **Step 3** > > For an expiration alert, enter **Alert Before** as a number and a unit. For example: `30d` or `2w`, up to 365 days. > > > [!NOTE] > > > > To get a reminder every day, turn on **Repeat daily until expiry**. Otherwise, the alert repeats on a [schedule based on **Alert Before**](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview#how-often-expiration-alerts-repeat). > > Select **Continue**. > > **Step 4** > > For an organization-wide alert, on the **Filters** step, optionally select **Add Filter** to [narrow the certificates the alert covers](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview#filter-an-organization-wide-alert), then select **Continue**. Application alerts and signer certificate expiration alerts skip this step. > > > [!TIP] > > > > To add this channel to an existing alert instead, edit the alert and go to its **Channels** step. > > On the **Channels** step, add the PagerDuty channel: > > **Step 1** > > Select **Add Channel** > **PagerDuty** and paste the key from [step 1](#step-1-get-a-pagerduty-integration-key) into **Integration key**. > > **Step 2** > > Optionally, select **Send test** to send a test event to the PagerDuty service. > > **Step 3** > > Select **Continue**, check the **Review** step, and select **Create Alert**. > [tab] API > > Send a request to the create alert endpoint with an [access token](https://infisical.com/docs/api-reference/overview/authentication.md) and a `pagerduty` channel, and set `integrationKey` in the channel's `config` to the key from [step 1](#step-1-get-a-pagerduty-integration-key). > > Set `resourceType` and `resourceId` to the certificates the alert covers: > > | Alert | `resourceType` | `resourceId` | > | - | - | - | > | Organization-wide | `cert-manager` | Leave out | > | Application | `cert-manager.application` | The application's ID, from [the list applications endpoint](https://infisical.com/docs/api-reference/endpoints/pki/applications/configuration/list.md) | > | Signer certificate expiration | `cert-manager.signer` | Leave out | > > Set `eventType` to the event the alert watches: > > | Event | Organization-wide alert | Application alert | > | - | - | - | > | Expiration | `cert-manager.certificate.expiry` | `cert-manager.application.certificate.expiry` | > | Issuance | `cert-manager.certificate.issuance` | `cert-manager.application.certificate.issuance` | > | Renewal | `cert-manager.certificate.renewal` | `cert-manager.application.certificate.renewal` | > | Revocation | `cert-manager.certificate.revocation` | `cert-manager.application.certificate.revocation` | > | Signer certificate expiration | `cert-manager.signer.certificate.expiry` | Not available | > > Set `condition` to the same settings as the **Alert Before** field, the **Repeat daily until expiry** toggle, and the **Filters** step in Infisical: > > | Field | Applies to | Value | > | - | - | - | > | `alertBefore` | Expiration alerts (required) | A number and a unit, such as `30d` or `2w`, up to 365 days | > | `dailyReminder` | Expiration alerts | `true` to [repeat the alert every day](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview#how-often-expiration-alerts-repeat) until the certificate expires | > | `applicationIds` | Organization-wide alerts | Up to 100 application IDs | > | `profileIds` | Organization-wide alerts | Up to 100 certificate profile IDs | > | `sources` | Organization-wide alerts | Any of `issued` (**Managed** in Infisical), `imported`, and `discovered` | > | `signerIds` | Signer certificate expiration alerts | Up to 100 signer IDs | > > For issuance, renewal, and revocation alerts on an application, leave out `condition`. > > ```bash Organization-wide theme={"dark"} > curl --request POST \ > --url https://app.infisical.com/api/v1/alerts \ > --header 'Authorization: Bearer ' \ > --header 'Content-Type: application/json' \ > --data '{ > "name": "certificates-expiring-this-month", > "resourceType": "cert-manager", > "eventType": "cert-manager.certificate.expiry", > "condition": { "alertBefore": "30d", "dailyReminder": true }, > "channels": [ > { > "name": "pki-on-call", > "channelType": "pagerduty", > "config": { "integrationKey": "" } > } > ] > }' > ``` > > ```bash Application theme={"dark"} > curl --request POST \ > --url https://app.infisical.com/api/v1/alerts \ > --header 'Authorization: Bearer ' \ > --header 'Content-Type: application/json' \ > --data '{ > "name": "payments-api-revocations", > "resourceType": "cert-manager.application", > "resourceId": "", > "eventType": "cert-manager.application.certificate.revocation", > "channels": [ > { > "name": "payments-on-call", > "channelType": "pagerduty", > "config": { "integrationKey": "" } > } > ] > }' > ``` > [!TIP] > > Your alert is set up. Infisical opens a PagerDuty incident whenever the alert fires. ## Severity mapping Each incident's PagerDuty severity comes from the alert's event. For expiration alerts, it comes from how close the certificate is to expiry. ### Expiration alerts | Time until expiry | PagerDuty severity | | - | - | | 7 days or less | `critical` | | 8 to 14 days | `error` | | 15 to 30 days | `warning` | | More than 30 days | `info` | ### Other alert events | Event | PagerDuty severity | | - | - | | Issuance | `info` | | Renewal | `info` | | Revocation | `warning` | ## Incident grouping Each certificate gets its own incident. If the same alert fires again for the same certificate, PagerDuty updates the existing incident instead of opening a new one. Each PagerDuty channel opens at most 10 incidents per run. If more than 10 certificates are due for an expiration alert, the ones closest to expiry go first and the rest go on the next daily run. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.