FireHydrant

Connect FireHydrant so agents can review open incidents, Signals alerts, severity, and which team owns each service

Connect FireHydrant and CloudThinker agents can list open and recent incidents, read Signals alerts (FireHydrant’s alerting and paging product) and whether each became an incident, and look up which team owns a service. The connection uses a FireHydrant API key and is read-only: agents never declare, update, page, assign, or publish anything in FireHydrant, even if you ask.

Prerequisites

• A FireHydrant user with the Owner role. FireHydrant only lets Owners create API keys.
• A key created only for CloudThinker, so you can delete it without breaking another integration.
• Edit permission on connections in your CloudThinker workspace.

A FireHydrant API key carries Owner permissions and can’t be scoped down. CloudThinker only sends read requests with it, but store and rotate it like an Owner credential.

Setup

1. Create an API key in FireHydrant

   Sign in to FireHydrant as an Owner and go to Settings → API Keys. Click + Create API key, name it cloudthinker, add a description such as “CloudThinker read-only connection”, and click Save.

   Copy the token right away. FireHydrant shows it only once, so a lost token means creating a new key.

2. Add the connection in CloudThinker

   In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for FireHydrant and click Connect.

   Paste the token into API Key and click Connect. CloudThinker tests the key against FireHydrant’s read API.

   Success state: the connection shows Connected, and the test message names your organization, for example FireHydrant read-only connection verified (Example Org).

Connection details

Field	Description	Example
API Key	The FireHydrant API key from Settings → API Keys	<your-api-key>

There’s no region or URL to enter. One key covers one FireHydrant organization.

Required permissions

FireHydrant has no scoped keys: every key is Owner-level. CloudThinker limits itself instead. For this connection, agents can run only three read commands (discovery, incidents, and alerts), and those only read from FireHydrant. CloudThinker blocks any other command before it runs.

Goal	What you need
Read incidents, alerts, services, and teams	A FireHydrant API key (always Owner-level)
Declare, update, or resolve incidents	Not supported. Do it in FireHydrant.

Use a dedicated key named cloudthinker and delete it when you remove the connection. Deleting the key stops this connection only.

Agent capabilities

Capability	What agents can do
Discovery	Read the organization, services with their owning and responding teams, teams, and the severity, priority, and milestone names your account uses
Incident review	List open or recent incidents with milestone, severity, priority, timestamps, impacted services, assigned teams, and a link to each incident
Alert review	List Signals alerts with status, priority, integration, owning team, how many incidents each one created, and FireHydrant’s noise flag. Needs FireHydrant Signals: without it, there are no alerts to read
Service health	Show the number of active incidents per service

If you ask for a change, the agent says it can’t make it and names the FireHydrant page where you can.

Defaults and limits

Read	Default window	Default rows	Max rows
Incidents	Last 168 hours (7 days), by when the incident was opened	20	100
Alerts	Last 24 hours	25	100
Discovery	Not time-bound	15 per section	100

Every answer reports how many rows it read and how many FireHydrant matched. When those differ, ask for more rows (up to 100) or a shorter window before treating the answer as complete. There’s no paging past 100 rows, so narrow the window instead, for example List FireHydrant incidents from the last 30 days, up to 100 rows.

Verify the connection

Run FireHydrant discovery and summarize the organization, the severity names this account uses, and how many services and teams you can read

A working connection names your organization and lists your severities, such as SEV1 and SEV2. An error such as “FireHydrant rejected the API key” means the key needs replacing.

Example prompts

List the FireHydrant incidents that are still open, with severity and impacted services
Which Signals alerts fired in the last 24 hours and never became an incident?
Which team owns the checkout service in FireHydrant, and does it have an active incident?
Summarize FireHydrant incidents from the last 30 days by severity and impacted service

Troubleshooting

FireHydrant rejected the API key

FireHydrant answered 401. The key was copied incompletely or revoked. Create a new key in Settings → API Keys. In CloudThinker, open FireHydrant in More → Workspace settings → Connections, click the pencil icon on the account’s row, click Replace… in Edit Instance, paste the key, and click Save and test.

FireHydrant accepted the key but refused the request

FireHydrant answered 403. Because keys are always Owner-level, this isn’t a permissions problem. Check that the key still exists in Settings → API Keys. If it’s gone, create a new one and replace it in CloudThinker. If the key is there, the organization’s account may be suspended: contact FireHydrant support.

FireHydrant rate-limited the test

FireHydrant answered 429. Its limit is 50 requests every 10 seconds, shared by every API key in the organization, so another integration can use it up. Wait a minute and test again.

Could not reach the FireHydrant API

CloudThinker couldn’t connect to FireHydrant at all. Check FireHydrant’s status, then connect again.

A filtered question returns nothing

FireHydrant returns an empty list, not an error, for a severity, priority, or team name your account doesn’t use. Ask the agent to run discovery first, then repeat the question with the exact names it returns, such as SEV1 instead of SEV-1.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Owner-level key. Keep it out of chat and repositories, paste it only into the connection dialog, and delete it in FireHydrant when you remove the connection.
• Rotate without downtime. Create a new key in FireHydrant, replace it in CloudThinker (pencil icon → Replace… → Save and test), and delete the old key once the test passes. See Rotate a credential.
• Read-only by design. CloudThinker only reads from FireHydrant on this connection, so a mistaken prompt can’t change an incident.
• Shared rate limit. Every integration on your FireHydrant organization shares one rate limit. Agents run one read at a time to stay under it.

Related

Resolve

Investigate incidents and find the root cause with CloudThinker

Rootly Connection

Triage incidents and review alerts in Rootly