# Alertmanager webhook

> Point a Prometheus Alertmanager webhook at PrismaLens so alerts open incidents and, by default, critical or high ones start an AI investigation by your coding agent.

You can always write an incident yourself. To have incidents open on their own, point Prometheus Alertmanager at PrismaLens.

## How alerts become incidents

* An alert reaches a service through its `service` label, which must equal the service’s name exactly.
* By default, a critical or high alert on a service starts an investigation when it arrives. Each service can change that, from always to never. An alert with no matching service starts no investigation.

## The webhook token

The first `pl up` writes a token to your workspace:

```text
~/.prismalens/PRISMALENS_WEBHOOK_SECRET_FILE
```

Every delivery must carry it.

## Configure Alertmanager

```yaml
receivers:
  - name: prismalens
    webhook_configs:
      - url: http://127.0.0.1:6473/api/webhooks/prometheus
        send_resolved: true
        http_config:
          authorization:
            type: Bearer
            credentials_file: /home/you/.prismalens/PRISMALENS_WEBHOOK_SECRET_FILE
```

Then route the alerts you care about to the `prismalens` receiver. Use your own port if you started PrismaLens with `--port`.

## Try it with curl

```bash
TOKEN=$(cat ~/.prismalens/PRISMALENS_WEBHOOK_SECRET_FILE)
curl -s -X POST http://127.0.0.1:6473/api/webhooks/prometheus \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"version":"4","status":"firing","alerts":[{"status":"firing","labels":{"alertname":"HighErrorRate","severity":"critical","service":"payments"},"annotations":{"summary":"5xx above 5% for 10 minutes"},"startsAt":"2026-09-13T10:00:00Z","fingerprint":"abc123"}]}'
```

With a service named `payments` that has code, that call opens an incident and starts an investigation.

## When Alertmanager runs on another machine

PrismaLens listens on `127.0.0.1`, so only this machine can reach it. To accept alerts from your network, start it with `pl up --host 0.0.0.0`. Over plain HTTP the traffic crosses the network in clear, so do this only on a network you trust.

> **A machine that is off misses alerts**
>
> A webhook needs PrismaLens running when the alert fires. Alertmanager sends again only with the group’s next notification, so an alert that fires and resolves while your machine sleeps may never arrive. Write the incident yourself for anything you missed.