PagerDuty

Manage PagerDuty incidents, notes, log entries, and users.

Overview

PagerDuty is an incident management platform for real-time operations. This tool provides operations for creating, retrieving, updating, and listing incidents, creating and listing incident notes, retrieving and listing log entries, and retrieving users via the PagerDuty REST API v2. Supports both API Token and OAuth2 authentication.

Category: Communication
Tool Name: pagerduty
Version: 1

Appearance: Icon: si-pagerduty | Color: #06AC38

Node Type

Action — processes input items and produces output

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires PagerDuty API Token or PagerDuty OAuth2 credentials — configure one of them. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Incident	incident
Incident Note	incidentNote
Log Entry	logEntry
User	user

Operations

Operation	Value	Description
Incident: Create	create	Create an incident
Incident: Get	get	Get an incident
Incident: Get Many	getAll	Get many incidents
Incident: Update	update	Update an incident
Incident Note: Create	create	Create an incident note
Incident Note: Get Many	getAll	Get many incident notes
Log Entry: Get	get	Get a log entry
Log Entry: Get Many	getAll	Get many log entries
User: Get	get	Get a user

Parameters

Incident: Create

Parameter	Type	Required	Default	Description
Title	string	Yes	—	A succinct description of the nature, symptoms, cause, or effect of the incident. Supports expressions.
Service ID	string	Yes	—	The ID of the PagerDuty service to create the incident on. Find it in PagerDuty under Services > Service Directory > click service > copy the ID from the URL. Supports expressions.
Email	string	Yes	—	The email address of a valid user associated with the account making the request. Sent as the From header. Supports expressions.
Additional Fields	collection	No	{}	Optional extra fields to set on the new incident.
— Escalation Policy ID	string	No	—	Delegate this incident to the specified escalation policy. Cannot be specified if an assignee is given. Find in PagerDuty under Escalation Policies.
— Incident Details	string	No	—	Additional details about the incident which will go in the body.
— Incident Key	string	No	—	Deduplication key. Subsequent requests with the same service and incident_key will be rejected if an open incident matches.
— Priority ID	string	No	—	Priority reference ID. Find available priorities via the PagerDuty Priorities API: GET /priorities.
— Urgency	options	No	—	The urgency of the incident.
				Options: high, low
Conference Bridge	fixedCollection	No	{}	Conference bridge details to attach to the incident.
— Conference Number	string	No	—	Phone number for the conference bridge. Format: +1 415-555-1212,,,,1234# (comma = 1s wait, # = end access code).
— Conference URL	string	No	—	URL for the conference bridge (e.g. a link to a web conference or Slack channel).

Incident: Get

Parameter	Type	Required	Default	Description
Incident ID	string	Yes	—	Unique identifier for the incident. Supports expressions.

Incident: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Options	collection	No	{}	Optional filters and sorting for the query.
— Date Range	options	No	—	When set to “all”, the since and until parameters and defaults are ignored.
				Options: all
— Incident Key	string	No	—	Incident deduplication key for filtering.
— Include	multiOptions	No	[]	Additional details to include in the response.
				Options: acknowledgers, assignees, conferenceBridge, escalationPolicies, firstTriggerLogEntries, priorities, services, teams, users
— Service IDs	string	No	—	Comma-separated list of service IDs to filter by. Only incidents for these services will be returned.
— Since	dateTime	No	—	Start of date range (max 6 months range).
— Sort By	string	No	—	Sort field and direction separated by colon. Max two fields, comma-separated. Fields: incident_number, created_at, resolved_at, urgency. Directions: asc, desc.
— Statuses	multiOptions	No	[]	Filter by incident statuses.
				Options: acknowledged, resolved, triggered
— Team IDs	string	No	—	Comma-separated team IDs. Only results related to these teams will be returned.
— Timezone	string	No	—	Timezone for dates in the response (e.g. “America/New_York”). If not set, dates return in UTC.
— Until	dateTime	No	—	End of date range (max 6 months range).
— Urgencies	multiOptions	No	[]	Filter by urgency levels.
				Options: high, low
— User IDs	string	No	—	Comma-separated user IDs. Returns only incidents currently assigned to these users.

Incident: Update

Parameter	Type	Required	Default	Description
Incident ID	string	Yes	—	Unique identifier for the incident to update. Supports expressions.
Email	string	Yes	—	The email address of a valid user associated with the account making the request. Sent as the From header. Supports expressions.
Update Fields	collection	No	{}	The fields to change on the incident.
— Escalation Level	number	No	0	Escalate the incident to this level in the escalation policy.
— Escalation Policy ID	string	No	—	Delegate this incident to the specified escalation policy. Find in PagerDuty under Escalation Policies.
— Incident Details	string	No	—	Updated body details for the incident.
— Priority ID	string	No	—	Priority reference ID for the incident.
— Resolution	string	No	—	Resolution text for this incident (applicable when status is set to resolved).
— Status	options	No	—	The new status of the incident.
				Options: acknowledged, resolved
— Title	string	No	—	A succinct description of the nature, symptoms, cause, or effect of the incident.
— Urgency	options	No	—	The urgency of the incident.
				Options: high, low
Conference Bridge	fixedCollection	No	{}	Conference bridge details to attach to the incident.
— Conference Number	string	No	—	Phone number for the conference bridge.
— Conference URL	string	No	—	URL for the conference bridge.

Incident Note: Create

Parameter	Type	Required	Default	Description
Incident ID	string	Yes	—	Unique identifier for the parent incident. Supports expressions.
Content	string	Yes	—	The note content. Supports expressions.
Email	string	Yes	—	The email address of a valid user associated with the account making the request. Supports expressions.

Incident Note: Get Many

Parameter	Type	Required	Default	Description
Incident ID	string	Yes	—	Unique identifier for the parent incident. Supports expressions.
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)

Log Entry: Get

Parameter	Type	Required	Default	Description
Log Entry ID	string	Yes	—	Unique identifier for the log entry. Supports expressions.

Log Entry: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Options	collection	No	{}	Optional filters for the query.
— Include	multiOptions	No	[]	Additional details to include in the response.
				Options: channels, incidents, services, teams
— Is Overview	boolean	No	false	Whether to return only the most important changes to the incident.
— Since	dateTime	No	—	Start of date range (max 6 months range).
— Timezone	string	No	—	Timezone for dates in the response. If not set, dates return in UTC.
— Until	dateTime	No	—	End of date range (max 6 months range).

User: Get

Parameter	Type	Required	Default	Description
User ID	string	Yes	—	Unique identifier for the user. Supports expressions.

All Operations

Parameter	Type	Required	Default	Description
Authentication	options	No	apiToken	Authentication method to use.
				Options: apiToken (uses the PagerDuty API Token credential), oAuth2 (uses the PagerDuty OAuth2 credential)
Max Concurrency	number	No	10	Maximum number of items to process concurrently.

Output Data

The PagerDuty record is merged onto the item JSON at the top level — the rest of the item passes through unchanged and binary data is forwarded — so downstream nodes read the returned fields directly, for example {{ $json.id }}.

Single-record operations produce one output item per input item:

Operation	What lands on the item
Incident: Create	The created incident record
Incident: Get	The requested incident record
Incident: Update	The updated incident record
Log Entry: Get	The requested log entry record
User: Get	The requested user record
Incident Note: Create	PagerDuty’s whole response envelope rather than the bare note, so the note’s own fields sit one level below the top of the item — inspect the item once to see the shape before writing expressions against it

Fan-out. Incident: Get Many, Incident Note: Get Many and Log Entry: Get Many return a list, and the node emits one output item per returned record instead of one per input item — each carrying the input item’s JSON plus that record’s fields. An input item whose query matches nothing produces no output items at all, so a downstream node may receive fewer items than were sent in. With Return All on, the node pages through every matching record; with it off, at most Limit records come back.

Failures are routed to the Error port in errorPort mode carrying _error.

Usage Examples

• Create a PagerDuty incident when a monitoring alert fires
• Get all open incidents from PagerDuty
• Update incident status to resolved
• Add a note to a PagerDuty incident
• Retrieve log entries for audit trail
• Look up a PagerDuty user by ID

Example Configuration

Raise an incident from an inbound monitoring alert, with details and a conference bridge:

{
  "type": "pagerduty",
  "parameters": {
    "resource": "incident",
    "operation": "create",
    "title": "{{ $json.alert.summary }}",
    "serviceId": "PSERVICE123",
    "email": "admin@example.com",
    "additionalFields": {
      "details": "Raised automatically from the monitoring alert stream",
      "escalationPolicyId": "PPOLICY456",
      "priorityId": "PPRIORITY789",
      "urgency": "high"
    },
    "conferenceBridgeUi": {
      "conferenceBridgeValues": {
        "conferenceNumber": "+1 415-555-1212,,,,1234#",
        "conferenceUrl": "https://meet.example.com/incident-bridge"
      }
    }
  }
}

List the open, high-urgency incidents raised since the start of the year, newest first:

{
  "type": "pagerduty",
  "parameters": {
    "resource": "incident",
    "operation": "getAll",
    "returnAll": false,
    "limit": 50,
    "options": {
      "statuses": ["triggered", "acknowledged"],
      "urgencies": ["high"],
      "since": "2026-01-01T00:00:00Z",
      "include": ["services", "assignees", "escalationPolicies"],
      "sortBy": "created_at:desc"
    }
  }
}

Acknowledge an incident and update its title while the team investigates:

{
  "type": "pagerduty",
  "parameters": {
    "resource": "incident",
    "operation": "update",
    "incidentId": "{{ $json.id }}",
    "email": "responder@example.com",
    "updateFields": {
      "status": "acknowledged",
      "title": "Database connectivity — investigating",
      "details": "Team is actively investigating the database connectivity issue"
    }
  }
}

Resolve an incident and record how it was fixed:

{
  "type": "pagerduty",
  "parameters": {
    "resource": "incident",
    "operation": "update",
    "incidentId": "{{ $json.id }}",
    "email": "responder@example.com",
    "updateFields": {
      "status": "resolved",
      "resolution": "Database service restarted; connections recovered",
      "urgency": "low"
    }
  }
}

Add a progress note to an incident:

{
  "type": "pagerduty",
  "parameters": {
    "resource": "incidentNote",
    "operation": "create",
    "incidentId": "{{ $json.id }}",
    "content": "Restarted the database service, monitoring for stability",
    "email": "responder@example.com"
  }
}

Pull every note on an incident, one output item per note:

{
  "type": "pagerduty",
  "parameters": {
    "resource": "incidentNote",
    "operation": "getAll",
    "incidentId": "{{ $json.id }}",
    "returnAll": true
  }
}

Collect a month of log entries for an audit trail, in local time:

{
  "type": "pagerduty",
  "parameters": {
    "resource": "logEntry",
    "operation": "getAll",
    "returnAll": false,
    "limit": 100,
    "options": {
      "since": "2026-01-01T00:00:00Z",
      "until": "2026-01-31T23:59:59Z",
      "include": ["incidents", "services"],
      "isOverview": true,
      "timeZone": "America/New_York"
    }
  }
}

Look up the user an incident is assigned to:

{
  "type": "pagerduty",
  "parameters": {
    "resource": "user",
    "operation": "get",
    "userId": "{{ $json.assignedUserId }}"
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

Manage PagerDuty incidents, notes, log entries, and users for incident response workflows.

Notes

• Authentication picks the credential. apiToken uses the PagerDuty API Token credential; oAuth2 uses the PagerDuty OAuth2 credential and refreshes an expired access token automatically. Configure the credential that matches the method you select.
• Email is an identity, not a notification. Create and update operations, and note creation, send it as the request’s From user, so it must be a real user on the account.
• Expressions resolve in the top-level fields only. Title, Service ID, Email, Incident ID, Content, Log Entry ID and User ID accept {{ $json.field }}; values typed inside Additional Fields, Update Fields, Options or Conference Bridge are sent to PagerDuty exactly as written, so put anything item-dependent in a top-level field.
• Deduplicate with Incident Key. While an incident with that key is still open on the same service, a repeat create is rejected rather than opening a second incident — so expect those items to reach the Error port.
• Conference Bridge holds a single bridge — one number and one URL — and is available on both Create and Update.
• Escalation Level 0 means “leave it alone”. Set 1 or higher to actually escalate.
• Date filters cover at most six months, so split longer audits into several runs.