More connectors
Connectors available today whose live certification is under way, with the settings each one needs.
These connectors are in the product and can be configured in the console today. They pass 3AM's contract tests; their live certification on the real product (as for PagerDuty, Kubernetes and Prometheus) is under way, and each will get a full guide like those when it is certified.
Monitoring
Grafana
Grafana URL and a viewer service-account token. Used for deploy/change annotations and datasource queries.
kind: grafanametrics and queries| Setting | What to enter | Required | Default |
|---|---|---|---|
url | Grafana base URL | yes | — |
datasource_uid | Default datasource UID for queries | no | — |
bearer_tokensecret | Bearer token, if required | no | — |
username | Basic-auth user, if required | no | — |
passwordsecret | Basic-auth password | no | — |
Grafana Alloy
The collector's HTTP listen address (/-/healthy and /metrics). Read-only, and 3AM needs no inbound port on the
collector itself. 3AM opens an incident when a component stops being healthy, or when Alloy's last configuration load
failed. On Alloy v1.x component health comes from the REST API, on older Alloy and Grafana Agent Flow from
alloy_component_healthy. Filling in k8s_namespace and k8s_deployment lets 3AM restart Alloy itself when the
whole collector goes down (see When a connector stops answering).
kind: alloyalerts in| Setting | What to enter | Required | Default |
|---|---|---|---|
url | Alloy HTTP base URL, e.g. http://alloy:12345 | yes | — |
bearer_tokensecret | Bearer token, if required | no | — |
username | Basic-auth user, if required | no | — |
passwordsecret | Basic-auth password | no | — |
k8s_namespace | Kubernetes namespace this Alloy runs in (enables connector.down restart action) | no | — |
k8s_deployment | Kubernetes Deployment name for this Alloy (enables connector.down restart action) | no | — |
Splunk
Management URL (port 8089) and an authentication token with search and alert-read rights. k8s_namespace and
k8s_deployment let 3AM restart Splunk itself when it goes down
(see When a connector stops answering).
kind: splunkalerts inmetrics and queries| Setting | What to enter | Required | Default |
|---|---|---|---|
url | Management API URL, e.g. https://splunk.bank:8089 | yes | — |
tokensecret | Authentication token | yes | — |
verify_tls | Verify the TLS certificate | yes | true |
app | App namespace for alerts | no | "search" |
metrics_index | Metrics index used by check packs (mstats) | no | "*" |
k8s_namespace | Kubernetes namespace this Splunk runs in (enables connector.down restart action) | no | — |
k8s_deployment | Kubernetes Deployment name for this Splunk (enables connector.down restart action) | no | — |
Datadog
An API key and an application key (read-only scopes are enough: dashboards_read, metrics_read,
monitors_read). Pick your Datadog site: EU accounts use datadoghq.eu. 3AM polls monitors in Alert
or Warn state as signals, and runs native metric queries for telemetry evidence. Monitors in No Data
state are not surfaced as signals; they indicate no agent is reporting, not an active alert.
Filling in k8s_namespace and k8s_deployment lets 3AM restart the Datadog agent deployment itself
when the connector goes down
(see When a connector stops answering).
kind: datadogalerts inmetrics and queries| Setting | What to enter | Required | Default |
|---|---|---|---|
site | Datadog site, e.g. datadoghq.com or datadoghq.eu | yes | "datadoghq.com" |
api_keysecret | API key | yes | — |
app_keysecret | Application key | yes | — |
api_url | Override API base URL (proxies, tests) | no | — |
k8s_namespace | Kubernetes namespace this Datadog runs in (enables connector.down restart action) | no | — |
k8s_deployment | Kubernetes Deployment name for this Datadog (enables connector.down restart action) | no | — |
Approvals
Slack
A bot token (xoxb-…) with chat:write, reactions:read, channels:history and users:read.email scopes.
Create a Slack app, add those bot scopes, install it to the workspace, and invite the bot to the approval channel
before configuring the connector. The channel ID is the C… value in the channel URL.
Approvers react ✅ to approve or ❌ to reject, or reply approve / reject in the message thread. 3AM polls
for reactions and replies, so nothing needs to connect in.
Health checks both token validity and channel access. A bad channel ID surfaces as channel_not_found on the
health check rather than at approval send time.
Filling in k8s_namespace and k8s_deployment lets 3AM restart the connector itself when it goes down
(see When a connector stops answering).
kind: slackapprovals| Setting | What to enter | Required | Default |
|---|---|---|---|
api_url | Web API base URL | yes | "https://slack.com/api" |
bot_tokensecret | Bot token (xoxb-…) | yes | — |
channel | Channel ID for approvals | yes | — |
approvers | Slack user IDs or e-mails allowed to approve | no | — |
k8s_namespace | Kubernetes namespace this Slack runs in (enables connector.down restart action) | no | — |
k8s_deployment | Kubernetes Deployment name for this Slack (enables connector.down restart action) | no | — |
Symphony
Create a bot service account with an RSA key in the Symphony admin portal, then upload its private key here.
Set pod_host, agent_host, and key_manager_host to the hostname only, with no https:// prefix. 3AM
adds the scheme itself. Approvers receive a 1:1 message with Approve / Reject buttons; 3AM polls the
datafeed for button presses, so nothing needs to connect in.
Filling in k8s_namespace and k8s_deployment lets 3AM restart the connector itself when it goes down
(see When a connector stops answering).
kind: symphonyapprovals| Setting | What to enter | Required | Default |
|---|---|---|---|
pod_host | Pod host, e.g. bank.symphony.com (hostname only, no https://) | yes | — |
agent_host | Agent host (often the same as the pod; hostname only) | no | — |
key_manager_host | Key manager host (often the same as the pod; hostname only) | no | — |
bot_username | Bot service account username | yes | — |
private_keysecret | Bot RSA private key (PEM file) | yes | — |
approvers | E-mail addresses of the people who may approve | no | — |
k8s_namespace | Kubernetes namespace this Symphony runs in (enables connector.down restart action) | no | — |
k8s_deployment | Kubernetes Deployment name for this Symphony (enables connector.down restart action) | no | — |
xMatters
Create a Flow Designer workflow whose form offers Approve and Reject, add an HTTP trigger, and paste that
trigger URL here with a REST API user that can read events. xMatters notifies the recipients and escalates through the
target group on its own; 3AM only reads the responses back, so it makes outbound connections only. Leave approvers
empty to accept a decision from anyone who was notified. The trigger URL carries the workflow's API key, so 3AM treats
it as a secret and redacts it from the errors it records.
Filling in k8s_namespace and k8s_deployment lets 3AM restart the connector itself when it goes down
(see When a connector stops answering).
kind: xmattersapprovals| Setting | What to enter | Required | Default |
|---|---|---|---|
base_url | Instance URL, e.g. https://acme.xmatters.com | yes | — |
username | REST API user | yes | — |
passwordsecret | REST API password | yes | — |
trigger_urlsecret | HTTP trigger URL of the approval workflow (contains its API key) | yes | — |
recipients | Default targets: group or user names | no | — |
approvers | User names allowed to approve (empty = anyone who was notified) | no | — |
k8s_namespace | Kubernetes namespace this xMatters runs in (enables connector.down restart action) | no | — |
k8s_deployment | Kubernetes Deployment name for this xMatters (enables connector.down restart action) | no | — |
Phone call (Twilio)
Use a Twilio account with a voice-capable number. 3AM creates and maintains its own Studio flow.
kind: twilio-voiceapprovals| Setting | What to enter | Required | Default |
|---|---|---|---|
account_sid | Account SID (AC…) | yes | — |
auth_tokensecret | Auth token | yes | — |
from_number | Twilio number calls come from, E.164 (+1…) | no | — |
approvers | Phone numbers that may approve, E.164 | no | — |
pin_sha256secret | Map of phone number → SHA-256 of that approver's PIN (enables PIN check) | no | {} |
Uses your SMTP relay to send and an IMAP mailbox to read replies. Low assurance: not used for high-risk actions.
kind: emailapprovals| Setting | What to enter | Required | Default |
|---|---|---|---|
smtp_host | SMTP host | yes | — |
smtp_port | SMTP port | yes | 587 |
smtp_starttls | Use STARTTLS | yes | true |
imap_host | IMAP host | yes | — |
imap_port | IMAP port (SSL) | yes | 993 |
imap_ssl | Use SSL for IMAP | yes | true |
username | Mailbox user (also the From address) | yes | — |
passwordsecret | Mailbox password | yes | — |
approvers | Addresses allowed to approve | no | — |
Systems
Database (SQL)
Databases have their own guide: Databases.
Servers (SSH)
Servers have their own guide: Servers (SSH).
Webhooks / runbook automation
Requests 3AM may make, e.g. trigger an Ansible Tower job or a Jenkins pipeline: {name: {method, url, body, params, risk, extract}}. risk: "read" marks a request that changes nothing (check packs may use it); extract returns one field of a JSON response.
kind: httpactions| Setting | What to enter | Required | Default |
|---|---|---|---|
requests | Request templates (JSON) | yes | — |
headerssecret | Headers sent with every request, e.g. an auth header | no | {} |
Code
GitHub
An organisation (or user) and a read-only token (fine-grained: Contents read, Metadata read). 3AM lists every
repository in the organisation and indexes the default branch of each. GitHub's API does not filter by archived
status server-side: include_archived: false is enforced client-side after the response is received.
Filling in k8s_namespace and k8s_deployment lets 3AM restart the connector itself when it goes down
(see When a connector stops answering).
kind: githubcode| Setting | What to enter | Required | Default |
|---|---|---|---|
owner | Organisation or user | yes | — |
tokensecret | Read-only token | yes | — |
api_url | API URL (GitHub Enterprise: https://ghe.bank/api/v3) | yes | "https://api.github.com" |
include_archived | Include archived repos | yes | false |
k8s_namespace | Kubernetes namespace this GitHub runs in (enables connector.down restart action) | no | — |
k8s_deployment | Kubernetes Deployment name for this GitHub (enables connector.down restart action) | no | — |
GitLab
GitLab URL, a group (or empty for everything the token sees) and a read_api + read_repository token. 3AM lists
every project in the group (and its subgroups) and indexes the default branch of each. include_archived: false
is enforced server-side: GitLab filters it in the API response, so archived projects are never fetched at all.
Language is populated from GitLab's predominant_language field, which GitLab computes asynchronously after a
repository is created or pushed to; new repos report unknown until GitLab finishes its scan.
Filling in k8s_namespace and k8s_deployment lets 3AM restart the connector itself when it goes down
(see When a connector stops answering).
kind: gitlabcode| Setting | What to enter | Required | Default |
|---|---|---|---|
url | GitLab base URL | yes | "https://gitlab.com" |
group | Group path (empty: all projects the token can read) | no | "" |
tokensecret | Access token | yes | — |
include_archived | Include archived projects | yes | false |
k8s_namespace | Kubernetes namespace this GitLab runs in (enables connector.down restart action) | no | — |
k8s_deployment | Kubernetes Deployment name for this GitLab (enables connector.down restart action) | no | — |
Bitbucket Cloud
A workspace slug and an Atlassian API token (create at id.atlassian.com → Security → API tokens; grant
read:repository:bitbucket and read:workspace:bitbucket scopes). Bitbucket injects a repo-scoped token
into HTTPS clone URLs. 3AM strips it before storing the URL so it never reaches the audit log; checkout
auth uses the configured token directly.
Bitbucket Cloud has no archive flag on repositories, so include_archived has no effect and can be left
at its default.
Filling in k8s_namespace and k8s_deployment lets 3AM restart the connector itself when it goes down
(see When a connector stops answering).
kind: bitbucketcode| Setting | What to enter | Required | Default |
|---|---|---|---|
workspace | Workspace slug | yes | — |
tokensecret | Access token | yes | — |
api_url | API URL | yes | "https://api.bitbucket.org/2.0" |
k8s_namespace | Kubernetes namespace this Bitbucket runs in (enables connector.down restart action) | no | — |
k8s_deployment | Kubernetes Deployment name for this Bitbucket (enables connector.down restart action) | no | — |
Git server (any)
For servers without a listing API (Gitea, Gerrit, on-prem mirrors): list the repository URLs.
kind: gitcode| Setting | What to enter | Required | Default |
|---|---|---|---|
repos | Repository URLs (https or ssh), one per line | yes | — |
branch | Branch to index | yes | "main" |
auth_headersecret | HTTP auth header for https URLs, if needed | no | — |
Tickets and CMDB
Jira
Jira URL, a project key and credentials (Cloud: e-mail + API token; Data Center: a personal access token).
kind: jiratickets| Setting | What to enter | Required | Default |
|---|---|---|---|
url | Jira base URL | yes | — |
project | Project key for incident tickets | yes | — |
issue_type | Issue type | yes | "Task" |
email | Account e-mail (Cloud) | no | — |
tokensecret | API token (Cloud) or personal access token (Data Center) | yes | — |
ServiceNow
ServiceNow has its own guide: ServiceNow.