Skip to content
StratumStratum Docs

Set or rotate the Platform Health operator webhook.

PUT
/v1/observability/admin/operator-webhook
Code sample: Shell / cURL
curl --request PUT \
  --url https://stratum.example.com/v1/observability/admin/operator-webhook \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "url": "https://ntfy.example.com/stratum-ops", "headers": { "Authorization": "Bearer tk_example" } }'

Cedar action observability:AdminAlerting.. Stores the URL in OpenBao, one copy per cluster. Every control plane reads it on its next pack pass, so a rotation takes effect without a restart. When a node has the STRATUM_OBSERVABILITY_OPERATOR_WEBHOOK_URL override set the write still lands, and the response reports source: env so the operator can see the override wins. The audit event records the operation, never the URL.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

. Body of PUT /v1/observability/admin/operator-webhook. A full replace: a body without headers stores none.

object
url
required

Absolute http or https URL the operator channel POSTs to.

string format: uri
<= 2048 characters

Example 

https://ntfy.example.com/stratum-ops
headers

. Request headers sent with every delivery, validated exactly as a webhook notification channel’s config.headers is (see NotificationChannel). Put a token here as Authorization: Bearer <token> rather than in the URL. Values are never returned.

object
<= 16 properties
key
additional properties
string
<= 4096 characters

Example 

{
  "Authorization": "Bearer tk_example"
}

Responses

Section titled “Responses”

200

Section titled “200”

Stored. Body is the effective operator webhook, redacted.

Media typeapplication/json

. The Platform Health pack’s operator webhook as the control plane resolves it: the per-node env override (STRATUM_OBSERVABILITY_OPERATOR_WEBHOOK_URL) when set, otherwise the cluster’s one copy in OpenBao. The URL is a secret (a notification token commonly rides in its query string), so it is only ever returned redacted.

object
configured
required

True when the pack has a URL to seed the operator channel with.

boolean
source
required

Where the effective URL comes from. env means the per-node override wins over the OpenBao copy (a PUT still stores the OpenBao copy, but it is not in effect on this node while the override is set).

string
Allowed values: env openbao none
url
required

The effective URL with its userinfo and every query value replaced by REDACTED; scheme, host, path and query keys are kept. Empty when source is none.

string
headers

. The request headers sent with every delivery, by name, each value REDACTED. Absent when there are none, and when the env override is in effect (it is a URL only).

object
key
additional properties
string

Example 

{
  "source": "env",
  "url": "https://ntfy.example.com/stratum-ops?auth=REDACTED",
  "headers": {
    "Authorization": "REDACTED"
  }
}

400

Section titled “400”

Bad request.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

403

Section titled “403”

Authenticated but not authorized.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

503

Section titled “503”

Upstream temporarily unavailable (driver / scheduler / dependency).

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}