migrate-from-pagerduty

Migrating from PagerDuty to ilert

The two products use overlapping words for different objects. Two of those collisions cause most migration defects, and neither is visible from the API spec.

For ilert's own semantics and the CLI behaviour behind a bulk import, read the ilert-essentials skill alongside this one. Where PagerDuty's own data lives — and how to hold a foreign API key while you read it — is under Reading the PagerDuty side below; start there when the job is extraction rather than design.

The two traps

A PagerDuty Service is not an ilert Service. PagerDuty's Service is the routing object: it receives events, owns the escalation policy, and holds the integration keys. In ilert that role belongs to the Alert Source. ilert's Service represents a business capability people subscribe to: it appears on status pages, carries outage history, and can be attached to alert sources and named as an affected service on an incident — but it owns no escalation policy and receives no events. Mapping PD Services onto ilert Services produces a topology that looks right and routes nothing.

A PagerDuty Incident is not an ilert Incident. PagerDuty's Incident is the actionable page. In ilert that is an Alert (PENDING → ACCEPTED → RESOLVED), created by an alert source and driven by an escalation policy. ilert's Incident sits a level above: a coordination record you declare for a significant event, which links alerts, pages responders, carries a timeline and an incident channel, and is what Status updates are posted from. PagerDuty has no single object for it — the closest is a PD incident after an Incident Workflow has been run against it.

PD incidents therefore map to ilert alerts, one for one. Mapping them onto ilert Incidents instead creates coordination records that no alert source feeds and no escalation policy drives.

Resource mapping

PagerDuty	ilert	Notes
Service	Alert Source	Carries escalationPolicy, integrationKey, integrationUrl
Integration (routing key)	Alert Source integrationKey / integrationUrl	New value; every emitter must be re-pointed
Escalation Policy	Escalation Policy	Rules hold escalationTimeout plus users / schedules / teams
Schedule	Schedule	type is STATIC or RECURRING
Schedule layer	scheduleLayers	Only on RECURRING schedules
Override	Shift, via PUT /schedules/{id}/overrides	Same Shift payload as a schedule shift, but its own endpoint; must not be in the past
Team	Team	visibility is PUBLIC or PRIVATE — only PRIVATE restricts, see below
User	User
Contact method	Contact	Separate objects per channel
Notification rule	Notification Preference	Split by priority and by notification type
Incident	Alert
Alert (PD's sub-object)	Alert	PD's incident/alert split collapses into one object; grouping is expressed through alertCreation and alertKey instead of a nested layer
Business Service	Service	Not only a status-page component: also attached to alert sources (services, autoCreateServices) and to incidents as affected services
Status page	Status Page	Page metrics map to Metric + Metric Data Source; see the migrate-from-statuspageio skill for the page-side detail
Status update template	Incident Template	sendNotification on the template decides whether subscribers are notified
Change Event	Deployment Event + Deployment Pipeline	Separate ingest endpoint and its own integration key — see below
Maintenance Window	Maintenance Window
Event Orchestration / Event Rules	Event Flow	A layer above alert sources with its own ingest URL — see below
Orchestration dynamic routing	Escalation Policy routingKey + Alert Source routingTemplate	Direct equivalent; usually replaces the orchestration outright — see below
Extension / Webhook	Alert Action + Connector	Connector holds the credentials, Alert Action the binding
Priority (P1–P5)	Alert severity, integer 1–5 on the event (displayed SEV1–SEV5)	One for one — see below
Urgency (high / low)	Alert priority HIGH / LOW	Priority stays two-valued; this is the faithful mapping
Response Play / Incident Workflow	Incident responders, incident channel, conference bridge — triggered by an ilert incidents Alert Action	The actions map, and the automatic trigger has an equivalent — see below
Postmortem	Postmortem	/incidents/{id}/postmortems — request, edit, delete, and attach external links
Live Call Routing	Call Flow + Call Flow Number	Routing targets differ and numbers cannot be ported — see below
Escalation policy num_loops	Escalation Policy repeating / frequency	Both are repeat counts, so this one transfers directly
Service acknowledgement_timeout	Alert Action on v-alert-not-resolved	ACCEPTED stops escalation by design; the reminder moves to an alert action — see below
Service auto_resolve_timeout	Alert Source autoResolutionTimeout	Absent means never
Service alert_grouping_parameters	Alert Source alertCreation + alertGroupingWindow	See below
User role	Role / TeamRole	Fixed enums (ADMIN, USER, RESPONDER, STAKEHOLDER, GUEST), (custom rbac roles require Enterprise plan)
Team member	/teams/{id}/members with TeamRole
On-call (/oncalls)	/on-calls	Not a migrated object; the endpoint to verify coverage after import
Status update on an incident	Status update	Posted from an ilert Incident, via /status-updates