1
The in-app toggle is locked — the channel can't be turned off: it's the fallback, an alert stays visible on sign-in even when email and webhooks are silent.
2
The toggle enables email delivery; it relies on the org SMTP — until SMTP is configured, the chip turns red and no mail goes out, leaving in-app and webhooks.
3
A webhook is an outbound POST to the admin's endpoint. Slack is a preset with a ready-made message format; generic sends a JSON payload. “Test” sends a sample event. The toggle pauses the channel: a verified endpoint is kept on standby (Ops), routes intact, no delivery until it's turned on again. How a new channel is set up — the add form.
Only the Owner edits channels and routing; the Admin sees them read-only.
The pills are a type's channels; clear them all and the type goes to no one. Left of the divider, individual recipients; right, webhooks.
onoffpausedlocked4
Sync — a run of failures, a source dropped, a lossy runcritical
In-app5EmailSlackOps
Security — brute force, role changescritical
In-appEmailSlackOps
Budget — AI spend thresholdcritical
In-appEmailSlackOps
System — provider unavailable, backup failed, Curation Pass crashedcritical
In-appEmailSlackOps
Discoveryv2 — a new container outside the source scopeinfo
In-app6EmailSlackOps
Recipients — Owner / Admin roles only. A dynamic slice by role: grant the role on the Users screen and the person joins the recipients; revoke it and they drop out. Individual channels (in-app · email) are each managed in one's own profile; an external recipient can't be created — a webhook serves a team or an on-call rotation. The matrix is about the organization's broadcast types; the personal types agent and account are addressed to a specific user (targeted) and each person manages them only in their own profile.
4
The pills are this type's channels: a filled dot means it goes here, an empty one means it doesn't, a dimmed one means the channel is paused (Ops, see the Channels block).
5
The lock on the in-app pill for security and sync — this channel can't be turned off: a critical signal always reaches at least the feed. The lock is organizational and in-app only — email and webhooks for these types are free, and one can still unsubscribe individually in the profile. It isn't tied to severity: system is also critical, yet it can be cleared entirely. Auth & Security.
6
Discovery v2 — “a new project X in Jira outside the allowed scope, add it?” with an action button right in the notification. It fires in the “Selected only” scope mode, when a source returns an object beyond the allow-list; in “Everything” mode there's no scope boundary — nothing to notify about. Harvester.
from Slack → Incoming Webhooks; stored encrypted 9
verified10
Generic preset · check failed
New webhook
FormatGeneric — JSON
payload
Name
Ops on-call
Endpoint URL
https://ops.company.com/hooks/achilles
Request signature (secret)
••••••••••••
optional — HMAC of the body for the receiver to verify; write-only 11
no response · 503
the endpoint returned an error — fix the address and check again
7
The modal opens from “+ Add webhook” in the Channels block with the preset already selected. The channel is created disabled — once added, it's turned on with the “Active” toggle in the list.
8
The preset defines both the field layout and the payload format: Slack — a ready-made message (only the Incoming Webhook URL is needed), Generic — neutral JSON to an arbitrary receiver (URL + optional signature). Only these two: we don't build a separate preset for Microsoft Teams — Teams accepts generic JSON via Power Automate Workflow (Microsoft retired the old Office 365 Connectors in May 2026).
9
The URL is written to url_enc, the optional HMAC secret to a separate secret_enc; both are encrypted and never returned to the UI (write-only). When editing an existing channel the fields come back empty: empty = “leave as is,” input = replace.
10
“Check” sends a sample event to the endpoint before saving — the same probe that later lives in the “Check” column and the “Test” menu item. A green chip means the endpoint accepted it.
11
A failed check shows the response code and blocks “Add”: a non-working channel won't make it into the list. The Generic secret is optional: we'll sign the body if the receiver verifies it.
v1 boundaries: custom headers and Authorization: Bearer — v2; a custom payload format isn't edited through a template — for a non-standard receiver, generic + n8n serves the purpose.
Only the Owner creates and edits channels; the Admin sees the form read-only.