---
title: PagerDuty connector
description: Use the PagerDuty data source to access and manage incidents, escalation policies, schedules, on-calls, users, and teams in PagerDuty.
url: https://docs-v3-preview.elastic.dev/elastic/kibana/pull/288525/reference/connectors-kibana/pagerduty-mcp-action-type
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview since 9.4
---

# PagerDuty connector
The PagerDuty data source connects to PagerDuty to access and manage incidents, escalation policies, schedules, on-calls, users, and teams. Use it in data and context sources and agentic workflows to search and retrieve PagerDuty data, and to take action by triggering, acknowledging, resolving, or updating incidents, adding responders, and running response plays.

## Create connectors in Kibana

You can create connectors in **Stack Management > Connectors**.

### Connector configuration

PagerDuty connectors have the following configuration properties:
<definitions>
  <definition term="MCP Server URL">
    The URL of the PagerDuty MCP server. Defaults to `https://mcp.pagerduty.com/mcp`.
  </definition>
  <definition term="API Key">
    Your PagerDuty API key. Enter it in the format `Token token=YOUR_API_KEY`. Refer to [Get API credentials](#pagerduty-mcp-api-credentials) for instructions.
  </definition>
</definitions>


## Test connectors

You can test connectors when you create or edit the connector in Kibana.

## Pagerduty connector actions

The PagerDuty connector exposes the following actions:
<definitions>
  <definition term="getUserData">
    Return the current PagerDuty user — the account that owns the API key. Returns id, name, email, summary, role, and teams. Use this to confirm which user the connector is authenticated as and to obtain your user ID and email for write actions that require the `from` parameter.
  </definition>
  <definition term="triggerIncident Elastic Cloud Serverless: Generally available Elastic Stack: Planned">
    Create a new PagerDuty incident. Requires a service ID (use `listServices` to find one), an incident title, and the `from` email of the acting user (call `getUserData` to retrieve it). Optionally accepts urgency, a body, an escalation policy override, and direct user assignments.
  </definition>
  <definition term="acknowledgeIncident Elastic Cloud Serverless: Generally available Elastic Stack: Planned">
    Acknowledge an active PagerDuty incident by its ID. Moves the incident status from "triggered" to "acknowledged". Requires the incident ID and the `from` email of the acting user.
  </definition>
  <definition term="resolveIncident Elastic Cloud Serverless: Generally available Elastic Stack: Planned">
    Resolve a PagerDuty incident by its ID. Moves the incident status to "resolved". Requires the incident ID and the `from` email of the acting user.
  </definition>
  <definition term="updateIncident Elastic Cloud Serverless: Generally available Elastic Stack: Planned">
    Update one or more fields on an existing PagerDuty incident (title, status, urgency, priority, or assignments). Requires the incident ID and the `from` email of the acting user.
  </definition>
  <definition term="listServices Elastic Cloud Serverless: Generally available Elastic Stack: Planned">
    List PagerDuty services. Supports free-text search and filtering by team IDs. Use this to look up a service ID before triggering an incident.
  </definition>
  <definition term="addResponders Elastic Cloud Serverless: Generally available Elastic Stack: Planned">
    Request additional responders for an active PagerDuty incident. Requires the incident ID, your user ID (call `getUserData` to retrieve it), a message, and at least one user ID or escalation policy ID to notify.
  </definition>
  <definition term="runResponsePlay Elastic Cloud Serverless: Generally available Elastic Stack: Planned">
    Execute a predefined PagerDuty response play against an incident. Requires the incident ID, the response play ID, the `from` email, and your user ID (call `getUserData` to retrieve it).
  </definition>
  <definition term="listIncidents">
    List PagerDuty incidents. Supports filtering by status, service IDs, user IDs, urgency, and date range. Supports sorting by incident_number, created_at, resolved_at, or urgency.
  </definition>
  <definition term="listSchedules">
    List PagerDuty on-call schedules. Supports free-text search and filtering by team or user IDs.
  </definition>
  <definition term="listEscalationPolicies">
    List PagerDuty escalation policies. Supports free-text search and filtering by user or team IDs.
  </definition>
  <definition term="listOncalls">
    Get current on-call assignments in PagerDuty. Supports filtering by schedule IDs, user IDs, or escalation policy IDs, and time range queries using ISO 8601 dates.
  </definition>
  <definition term="listUsers">
    List PagerDuty users. Supports free-text search across name and email fields.
  </definition>
  <definition term="listTeams">
    List PagerDuty teams. Supports free-text search across name and description fields.
  </definition>
  <definition term="getIncident">
    Get a specific PagerDuty incident by its ID. Returns the incident's summary, status, urgency, service, assignments, and timestamps.
  </definition>
  <definition term="getSchedule">
    Get a specific PagerDuty on-call schedule by its ID. Returns the schedule's name, description, time zone, layers, and assigned users.
  </definition>
  <definition term="getEscalationPolicy">
    Get a specific PagerDuty escalation policy by its ID. Returns the policy's name, escalation rules, associated services, and teams.
  </definition>
  <definition term="getTeam">
    Get a specific PagerDuty team by its ID. Returns the team's id, name, description, and summary.
  </definition>
  <definition term="listTools">
    List all tools available on the PagerDuty MCP server. Use this to discover available capabilities.
  </definition>
  <definition term="callTool">
    Call any tool on the PagerDuty MCP server directly by name. Use this as an escape hatch when a specific tool is not yet exposed as a named action.
  </definition>
</definitions>


## Connector networking configuration

Use the [Action configuration settings](/elastic/kibana/pull/288525/reference/configuration-reference/alerting-settings#action-settings) to customize connector networking, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use `xpack.actions.customHostSettings` to set per-host configurations.

## Get API credentials

To use the PagerDuty data source, you need a PagerDuty **API token**. This is not the same as an integration key used for the alerting connector.
1. Log in to [PagerDuty](https://www.pagerduty.com/).
2. Go to **Integrations** > **Developer Tools** > **API Access Keys** (or **User Settings** > **API Access** in some layouts).
3. Select **Create API User Token** (user token) or **Create Key** (general access key; requires admin). User tokens are scoped to your permissions.
4. Enter a description (for example, `Kibana data source`) and create the token.
5. Copy the token and store it securely. You cannot see it again after this point. Enter the token in the format `Token token=<your_token>` when configuring the connector.

For more details, refer to [PagerDuty API access keys](https://support.pagerduty.com/docs/api-access-keys) and [API authentication](https://developer.pagerduty.com/docs/rest-api-v2/authentication/).