PagerDuty Cheat Sheet

Key concepts and CLI/API usage for configuring PagerDuty services, escalation policies, on-call schedules, and incident response workflows.

2 PagesIntermediateJan 28, 2026

Core Concepts

The building blocks of a PagerDuty account.

Service- A monitored component (e.g. an API) that receives alerts and maps to an integration
Integration- A connection between a monitoring tool (Datadog, Prometheus, email) and a Service, each with its own integration key
Escalation Policy- Ordered rules defining who is notified and when if an incident is not acknowledged
On-Call Schedule- A rotation of users assigned to be paged during specific time windows
Incident- A triggered alert requiring action; has states Triggered, Acknowledged, Resolved
Urgency- High or Low; controls whether notifications interrupt (push/SMS/phone) or are low-priority
Event Orchestration- Rules engine that routes, suppresses, or enriches events before they create incidents

Events API v2 (Trigger/Resolve)

Send alerts programmatically to a PagerDuty service.

bash

# Trigger an incidentcurl -X POST https://events.pagerduty.com/v2/enqueue \  -H 'Content-Type: application/json' \  -d '{    "routing_key": "<INTEGRATION_KEY>",    "event_action": "trigger",    "dedup_key": "db-cpu-high-01",    "payload": {      "summary": "CPU usage above 90% on db-01",      "source": "monitoring-agent",      "severity": "critical"    }  }'# Resolve the same incident using dedup_keycurl -X POST https://events.pagerduty.com/v2/enqueue \  -H 'Content-Type: application/json' \  -d '{"routing_key":"<INTEGRATION_KEY>","event_action":"resolve","dedup_key":"db-cpu-high-01"}'

REST API (Incidents)

Query and manage incidents via the PagerDuty REST API.

bash

# List open incidents (requires Authorization: Token token=<API_KEY>)curl -H 'Authorization: Token token=<API_KEY>' \     -H 'Content-Type: application/json' \     'https://api.pagerduty.com/incidents?statuses[]=triggered&statuses[]=acknowledged'# Acknowledge an incidentcurl -X PUT https://api.pagerduty.com/incidents/<INCIDENT_ID> \  -H 'Authorization: Token token=<API_KEY>' \  -H 'Content-Type: application/json' \  -H 'From: oncall@example.com' \  -d '{"incident":{"type":"incident_reference","status":"acknowledged"}}'

Terraform Provider Basics

Manage PagerDuty resources as code.

pagerduty_service- Resource block defining a service, its escalation_policy, and alert_creation setting
pagerduty_escalation_policy- Defines rule blocks with target user/schedule IDs and escalation_delay_in_minutes
pagerduty_schedule- Defines layers with users, rotation_virtual_start and rotation_turn_length_seconds
pagerduty_service_integration- Attaches a vendor integration (e.g. Datadog) to a service, generating an integration key
terraform import- Bring existing PagerDuty resources under Terraform state before making changes

Pro Tip

Use dedup_key consistently per alert source so repeated Events API triggers update the same incident instead of spawning duplicates, and always send a matching resolve event when the underlying condition clears.

Was this cheat sheet helpful?

Splunk Cheat Sheet

Docker Compose Cheat Sheet