PagerDuty

Overview

Connect your users to PagerDuty for incident management, on-call scheduling, alert routing, and service health monitoring.

Property	Value
Provider ID	pagerduty
Category	Developer Tools
PKCE	Supported
Token refresh	Automatic
Redirect URI	Shown in Developer Portal

Step 1: Create a PagerDuty OAuth App

Go to the PagerDuty Developer Portal

Sign in to PagerDuty App Registration as a Manager, Global Admin or Account Owner. The PagerDuty OAuth documentation describes the setup fields.

Register the application

Go to Integrations > Developer Tools > App Registration, click New App, enter the name and description, and save.

Add Classic User OAuth

In the Functionality section click Add on the OAuth card, and on the Configure OAuth 2.0 screen choose Classic User OAuth (not Scoped OAuth). Classic User OAuth uses the read and write scopes offered here, and a user on any PagerDuty account can authorize the app. A private Scoped OAuth app only works on the account that registered it, uses dotted scopes such as users.read, and returns 403 on every API call when connected with the scopes offered here.

Configure the redirect URI

Add the Alter callback URL from the Developer Portal to the Redirect URL field.

Get credentials

Copy the Client ID and Client Secret.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add PagerDuty provider

Go to OAuth Providers > Add Provider > PagerDuty.

Enter credentials

• Client ID: Paste your PagerDuty Client ID
• Client Secret: Paste your PagerDuty Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
openid	Access to user identity information
read	Read-only access to every resource the authorizing user can see; requested unless write is selected
write	Read and write access to every resource the authorizing user can see; includes read, so a connection with write selected requests write alone

Notes

• PagerDuty honours one Classic permission level per token: read for read-only access or write for read/write access. read is always selected; selecting write requests write alone (it includes read), because PagerDuty grants a token holding only openid when both are named.
• See the PagerDuty OAuth documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
listIncidents	read	GET	/incidents
getIncident	read	GET	/incidents/{id}
createIncident	send, write	POST	/incidents
updateIncident	write	PUT	/incidents/{id}
updateIncidents	write	PUT	/incidents
mergeIncidents	write	PUT	/incidents/{id}/merge
createIncidentNote	write	POST	/incidents/{id}/notes
listIncidentNotes	read	GET	/incidents/{id}/notes
createIncidentStatusUpdate	send	POST	/incidents/{id}/status_updates
createIncidentNotificationSubscribers	write	POST	/incidents/{id}/status_updates/subscribers
listServices	read	GET	/services
createService	write	POST	/services
updateService	write	PUT	/services/{id}
deleteService	delete	DELETE	/services/{id}
listUsers	read	GET	/users
getUser	read	GET	/users/{id}
createUser	admin	POST	/users
deleteUser	admin, delete	DELETE	/users/{id}
listSchedules	read	GET	/schedules
getSchedule	read	GET	/schedules/{id}
listOnCalls	read	GET	/oncalls
listEscalationPolicies	read	GET	/escalation_policies