Skip to main content

Hi team,

I'm integrating PagerDuty with ServiceNow using the V3 webhook for incident events. While handling the incident.annotated event, I noticed that the webhook payload does not include key fields like status, service_id, or escalation_policy.id.

My current requirement is to prevent worknote updates in ServiceNow when a PagerDuty incident note is added — but only for one specific service.

Could you please advise:

  • Is there a way to enrich the incident.annotated payload to include service_id or escalation_policy.id?

  • Alternatively, is there a recommended approach to identify the service from the webhook and conditionally skip worknote updates in ServiceNow?

Any guidance or best practices would be greatly appreciated.

Hi ​@Mohan Mallapu, 

You actually can identify the service directly from the incident.annotated webhook payload, no extra API call needed! The payload’s event.data object includes a service field, which contains the id of the service related to the incident.

To implement your filter, just check event.data.service.id in your webhook handler and compare it to your target service. If it matches, you can skip the worknote update in ServiceNow.

For more details and a full breakdown of the payload structure, I recommend checking out the Event Data Types section in the PagerDuty Webhooks V3 documentation. It has example payloads and explains exactly what’s included for each event type.

Hope this helps! Enjoy your day!

Hi ​@lupimiguel ,

Thank you for the response. I tried with the same; however, I am unable to get the service ID.

Could you please share the sample payload for incident.annotated event type??


​​​​

Hi ​@Mohan Mallapu, 

Absolutely, a sample payload for the incident.annotated event type from PagerDuty Webhooks V3 looks like this. You’ll see that the service object (with its id) is included under event.data:

{
  "event": {
    "event_type": "incident.annotated",
    "data": {
      "id": "Q2DGVPTAGDY34J",
      "type": "incident",
      "summary": "Example incident summary",
      "service": {
        "id": "PYOQREP",
        "summary": "Example Service",
        "type": "service_reference"
      },
      "escalation_policy": {
        "id": "OP56E0H",
        "summary": "Example Escalation Policy",
        "type": "escalation_policy_reference"
      },
      "notes": [
        {
          "id": "note_id",
          "content": "This is a test note",
          "user": {
            "id": "USERID",
            "summary": "User Name",
            "type": "user_reference"
          },
          "created_at": "2025-09-11T10:00:00Z"
        }
      ]
      // ... other fields ...
    }
  }
}

You can find more details and additional payload examples in the Event Data Types section of the PagerDuty Webhooks V3 documentation.

Hope this helps!

 Hi ​@lupimiguel , 

Here, I am sharing the payload that I am getting from the incident. It is an annotated webhook event type in ServiceNow.

{
    "id": "01FZH3ZWU8PDXDP6YGXD1QL85Y",
    "event_type": "incident.annotated",
    "resource_type": "incident",
    "occurred_at": "2025-09-11T13:29:36.051Z",
    "agent": {
        "id": "PTJA039",
        "type": "user_reference",
        "self": "https://api.pagerduty.com/users/PTJA036",
        "html_url": "https://mycompany.pagerduty.com/users/PTJA036",
        "summary": "Mohan M"
    },
    "client": null,
    "data": {
        "incident": {
            "id": "Q0A4AK6KPK116A",
            "type": "incident_reference",
            "self": "https://api.pagerduty.com/incidents/Q0A4AK6KPK116A",
            "html_url": "https://mycompany.pagerduty.com/incidents/Q0A4AK6KPK116A",
            "summary": "INC0424588:*TEST Clocked out of Okta"
        },
        "id": "PNAWPIN",
        "content": "test comment 6",
        "trimmed": false,
        "type": "incident_note"
    }
}

And also, in the official document as well, I don’t see the data.service.id in the incident_note  payload.

developer.pagerduty.com/docs/webhooks-overview#incident_note 

Hi ​@Mohan Mallapu,

You can ignore my previous responses, I wrongly assumed the payload sent would be for the incident and not limited to incident_note:

This means that, unfortunately for now, you cannot filter by service using only the webhook payload for this event type. The best practice in this scenario is to use the incident.id from the payload and make a follow-up API call to the Get Incident endpoint to retrieve the full incident details, including the service.id.

This is currently a limitation, and I’ll put up a request for clarification with the API team, using your use case as reference. 

Thank you so much for the quick response. I will go with a REST API call to get the details..

Terms & ConditionsCookie settingsAccessibility statement