Skip to main content

PagerDuty✓ Verified

· 13 min read
Pradeep Kadambar
Pradeep Kadambar
Creator
PagerDuty is an incident management platform that centralises alerts, on-call schedules, and escalation policies. Users are organised into Teams and assigned a system-level role that controls their access across the account.

Identities ❌ | Accounts ✔️ | Groups ✔️ | App Roles ✔️ | Entitlements ❌

Permission Model​

Teams​

Teams organize users and control access to escalation policies, schedules, and services. A user can be a member of multiple teams.

User Roles​

Each user is assigned exactly one system-level role controlling their access across the PagerDuty account.

RoleDescription
ownerAccount owner. Full access to all objects plus billing and subscription management. Only one per account.
adminFull access to all objects and configurations. Can manage users, teams, schedules, escalation policies, services, and integrations.
userCan view and edit most objects. Can acknowledge, resolve, and create incidents.
limited_userCan view most objects but cannot edit them. Can acknowledge incidents.
observerCan view objects but cannot make any modifications.
read_only_userCan view objects but cannot make any modifications.
read_only_limited_userCan only view objects they have been explicitly granted access to.
restricted_accessCan only view incidents and alerts they are directly involved in.

Application​

Steps

  1. Login to RSA G&L console as System Administrator.
  2. Navigate to Resources > Application.
  3. Click on Create Application and select Other Application.
  4. Enter the details as shown below.
    img
  5. Click Finish.

Account Collector​

Uses the RSA G&L Generic REST collector 1.

Steps

  1. Login to RSA G&L console as System Administrator.
  2. Navigate to Resources > Applications.
  3. Click on PagerDuty.
  4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.

    img
  5. Click Next and enter the connection details.

    img
  6. Click Next. Select the data types that the collector will be collecting from PagerDuty

    img
  7. Click Next. On the Account Data page, enter the following configurations.

    Alt text

    Alt text

    Alt text
Request
MethodGET
URL/users
Request Headers
Acceptapplication/json
AuthorizationToken token=${AuthenticationToken}
Response Mappings
AccountId$.users.*.email
Id$.users.*.id
Type$.users.*.type
  1. Click Next. On the Group Data page, enter the following configurations.

    Alt text

    Alt text

    Alt text

Request
MethodGET
URL/teams
Query Parameters
fieldsid,name
Request Headers
Acceptapplication/json
AuthorizationToken token=${AuthenticationToken}
Response Mappings
GroupId$.teams.*.name
Id$.teams.*.id
Description$.teams.*.description
  1. Click Next. On the Account Group Membership page, enter the following configurations.

    Alt text

    Alt text

    Alt text

Request
MethodGET
URL/teams/${Id}/members
Request Headers
Acceptapplication/json
AuthorizationToken token=${AuthenticationToken}
Response Mappings
Account Identifier$.members.*.user.id
  1. Click Next. In the Map Collector Attributes to Account Attributes, map the collected account attributes.

    Alt text
  2. Click Next. In the Map Collector Attributes to Account Mapping Attributes, map the user reference attribute.

    Alt text
  3. Click Next. In the Map Collector Attributes to Group Attributes, map the collected group attributes.

    Alt text
  4. Click Next. In the User Resolution Rules, map the user to account.

    Alt text
  5. Click Next. In the Member Account Resolution Rules, map the account.

    Alt text
info

This value MUST always be mapped to the Account Name for any generic REST collector.

  1. Click Finish. Use the Test function to make sure the configurations are accurate.

Entitlement Collector​

info

PagerDuty does not provide an API for listing user roles. A custom web service is used for the EDC. See Custom Web Service : User Roles.

Steps

  1. Login to RSA G&L console as System Administrator.
  2. Navigate to Resources > Applications.
  3. Click on PagerDuty.
  4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.

    Alt text
  5. Click Next and enter the connection details as shown in Step 5 of Account Collector. Use Base URL for all API(s) will be unchecked.
  6. Click Next. Select the data types that the collector will be collecting from PagerDuty.

    Alt text
  7. Click Next. On the App Role Data page, enter the following configurations.

    Alt text

Request
MethodGET
URLhttps://instance.securid.com/aveksa/custom/external_jsp/PagerDutyUserRolesv1.jsp
Request Headers
Acceptapplication/json
Response Mappings
ApplicationRoleId$.roles.*.role
Description$.roles.*.description
  1. Click Next. On the App-Role Account Membership collection page, enter the following configurations.

    Alt text

    Alt text

    Alt text

Request
MethodGET
URLhttps://api.pagerduty.com/users
Request Headers
Acceptapplication/json
AuthorizationToken token=${AuthenticationToken}
Response Mappings
Application Role Id$.users.*.role
Account Identifier$.users.*.id
  1. Click Next. In the Map Collector Attributes to App Role Attributes, map the collected account attributes.

    Alt text
  2. Click Next. In the Account Evaluation, map the account collector to account value.

    Alt text
  3. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

Application Setup​

Steps

  1. Login to PagerDuty console https://instance.pagerduty.com.
  2. Under Integrations, click on API Access Keys.

    Alt text
  3. Click on Create new API key.
  4. Provide a meaningful name. Since we are going to use this key for collections, check the Read-only API Key option.
    Alt text
  5. Click on Create Key.
    Alt text
  6. Copy the Secret and click Done.

Custom Web Service​

User Roles​

Steps

  1. Open a text editor and save the contents below as PagerDutyUserRolesv1.jsp
<%@ page language="java" contentType="application/json" %>
<%
    String jsonData = "{"
        + "\"roles\": ["
        + "{\"role\":\"admin\",\"description\":\"Has full access to all objects and configurations in the account. Can create, update, and delete users, teams, schedules, escalation policies, services, and integrations. Can also manage user permissions.\"},"
        + "{\"role\":\"limited_user\",\"description\":\"Can view most objects but cannot edit them. Can acknowledge incidents.\"},"
        + "{\"role\":\"observer\",\"description\":\"Can view objects, but cannot make any modifications.\"},"
        + "{\"role\":\"owner\",\"description\":\"Account owner. Full access to all objects plus billing and subscription management. Only one per account.\"},"
        + "{\"role\":\"read_only_user\",\"description\":\"Can view objects, but cannot make any modifications.\"},"
        + "{\"role\":\"restricted_access\",\"description\":\"Can only view incidents and alerts that they are directly involved in.\"},"
        + "{\"role\":\"read_only_limited_user\",\"description\":\"Can only view objects that they have been granted access to.\"},"
        + "{\"role\":\"user\",\"description\":\"Can view and edit most objects. Can acknowledge, resolve, and create incidents.\"}"
        + "]"
        + "}";
%>

<%
    response.setContentType("application/json");
    out.print(jsonData);
%>
  1. Login to RSA G&L console as System Administrator.
  2. Navigate to Admin > User Interface.
  3. Click on Files.
  4. Select External JSP Pages and click on Upload.
  5. Select the PagerDutyUserRolesv1.jsp and click OK.
  6. Verify by accessing this URL in the browser https://instance.securid.com/aveksa/custom/external_jsp/PagerDutyUserRolesv1.jsp

API​

List Users​

API Reference : https://developer.pagerduty.com/api-reference/e960832de5a46-list-users

 http GET /users
API FieldRSA G&L FieldNotes
users[].emailAccount IDUsed as the primary account identifier
users[].idIdPagerDuty internal user ID; used to join role assignments
users[].typeTypeAlways user
users[].role(see Role Assignments)System role; also used in App-Role Account Membership
users[].nameDisplay NameFull name
{
  "users": [
    {
      "id": "P1234AB",
      "type": "user",
      "name": "Jane Smith",
      "email": "jane.smith@example.com",
      "role": "user",
      "job_title": "On-Call Engineer",
      "time_zone": "America/New_York",
      "billed": true
    }
  ],
  "offset": 0,
  "limit": 25,
  "more": false,
  "total": 1
}

List Teams​

API Reference : https://developer.pagerduty.com/api-reference/8d4e989c1c653-list-teams

 http GET /teams?fields=id,name
API FieldRSA G&L FieldNotes
teams[].nameGroup IDUsed as the group identifier in RSA G&L
teams[].idIdPagerDuty internal team ID; used in the membership query
teams[].descriptionDescriptionTeam description
{
  "teams": [
    {
      "id": "P3ZQXDF",
      "type": "team",
      "name": "Engineering",
      "description": "Core engineering team"
    },
    {
      "id": "P7ABCDE",
      "type": "team",
      "name": "Operations",
      "description": "Operations and SRE team"
    }
  ],
  "offset": 0,
  "limit": 25,
  "more": false,
  "total": 2
}

List Team Members​

API Reference : https://developer.pagerduty.com/api-reference/e35802f3c4ba4-list-members-of-a-team

 http GET /teams/{id}/members
API FieldRSA G&L FieldNotes
members[].user.idAccount IdentifierJoins to Account Collector id field
members[].role(informational)Team-level role: responder, manager, observer. Separate from the account-level role in /users.
{
  "members": [
    {
      "user": { "id": "PABC123", "type": "user_reference" },
      "role": "responder"
    },
    {
      "user": { "id": "PDEF456", "type": "user_reference" },
      "role": "responder"
    },
    {
      "user": { "id": "PGHI789", "type": "user_reference" },
      "role": "manager"
    }
  ],
  "limit": 100,
  "offset": 0,
  "more": false,
  "total": null
}

User Roles (Custom Web Service)​

PagerDuty does not expose an API for listing available user roles. A custom JSP hosted on the RSA G&L server serves the static role catalogue. See Custom Web Service : User Roles for setup.

 http GET https://instance.securid.com/aveksa/custom/external_jsp/PagerDutyUserRolesv1.jsp
API FieldRSA G&L FieldNotes
roles[].roleApplication Role IDRole identifier, e.g. admin, user, observer
roles[].descriptionDescriptionRole description shown in access certifications
{
  "roles": [
    { "role": "admin",      "description": "Full access to all objects and configurations." },
    { "role": "user",       "description": "Can view and edit most objects. Can acknowledge, resolve, and create incidents." },
    { "role": "observer",   "description": "Can view objects but cannot modify them." },
    { "role": "owner",      "description": "Account owner. Full access plus billing and subscription management." },
    { "role": "limited_user",           "description": "Can view most objects but cannot edit them. Can acknowledge incidents." },
    { "role": "read_only_user",         "description": "Can view objects but cannot modify them." },
    { "role": "read_only_limited_user", "description": "Can only view objects explicitly granted access to." },
    { "role": "restricted_access",      "description": "Can only view incidents and alerts they are directly involved in." }
  ]
}

Role Assignments​

API Reference : https://developer.pagerduty.com/api-reference/e960832de5a46-list-users

 http GET /users

The same /users endpoint is used for role assignment collection. Each user record carries their system role in the role field, giving the account-to-role mapping in a single pass.

API FieldRSA G&L FieldNotes
users[].roleApplication Role IDJoins to User Roles catalogue
users[].idAccount IdentifierJoins to Account Collector id field
{
  "users": [
    {
      "id": "P1234AB",
      "email": "jane.smith@example.com",
      "role": "user"
    },
    {
      "id": "P5678CD",
      "email": "bob.jones@example.com",
      "role": "admin"
    }
  ]
}

References​

COL008

Footnotes​

  1. PagerDuty API ↩