> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # FireHydrant > Connect FireHydrant so agents can review open incidents, Signals alerts, severity, and which team owns each service Connect FireHydrant and CloudThinker agents can list open and recent incidents, read Signals alerts (FireHydrant's alerting and paging product) and whether each became an incident, and look up which team owns a service. The connection uses a FireHydrant **API key** and is **read-only**: agents never declare, update, page, assign, or publish anything in FireHydrant, even if you ask. ## Prerequisites * A FireHydrant user with the **Owner** role. FireHydrant only lets Owners create API keys. * A key created only for CloudThinker, so you can delete it without breaking another integration. * Edit permission on connections in your CloudThinker workspace. > [!WARNING] > > A FireHydrant API key carries Owner permissions and can't be scoped down. CloudThinker only sends read requests with it, but store and rotate it like an Owner credential. ## Setup **1. Create an API key in FireHydrant** Sign in to FireHydrant as an Owner and go to **Settings → API Keys**. Click **+ Create API key**, name it `cloudthinker`, add a description such as "CloudThinker read-only connection", and click **Save**. Copy the token right away. FireHydrant shows it only once, so a lost token means creating a new key. **2. Add the connection in CloudThinker** In the sidebar, click **More → Workspace settings → Connections**. On the **Builtin Connections** tab, search for **FireHydrant** and click **Connect**. Paste the token into **API Key** and click **Connect**. CloudThinker tests the key against FireHydrant's read API. **Success state:** the connection shows **Connected**, and the test message names your organization, for example `FireHydrant read-only connection verified (Example Org)`. ## Connection details | Field | Description | Example | | - | - | - | | **API Key** | The FireHydrant API key from **Settings → API Keys** | `` | There's no region or URL to enter. One key covers one FireHydrant organization. ## Required permissions FireHydrant has no scoped keys: every key is Owner-level. CloudThinker limits itself instead. For this connection, agents can run only three read commands (discovery, incidents, and alerts), and those only read from FireHydrant. CloudThinker blocks any other command before it runs. | Goal | What you need | | - | - | | Read incidents, alerts, services, and teams | A FireHydrant API key (always Owner-level) | | Declare, update, or resolve incidents | Not supported. Do it in FireHydrant. | > [!TIP] > > Use a dedicated key named `cloudthinker` and delete it when you remove the connection. Deleting the key stops this connection only. ## Agent capabilities | Capability | What agents can do | | - | - | | **Discovery** | Read the organization, services with their owning and responding teams, teams, and the severity, priority, and milestone names your account uses | | **Incident review** | List open or recent incidents with milestone, severity, priority, timestamps, impacted services, assigned teams, and a link to each incident | | **Alert review** | List Signals alerts with status, priority, integration, owning team, how many incidents each one created, and FireHydrant's noise flag. Needs FireHydrant Signals: without it, there are no alerts to read | | **Service health** | Show the number of active incidents per service | If you ask for a change, the agent says it can't make it and names the FireHydrant page where you can. ### Defaults and limits | Read | Default window | Default rows | Max rows | | - | - | - | - | | Incidents | Last 168 hours (7 days), by when the incident was opened | 20 | 100 | | Alerts | Last 24 hours | 25 | 100 | | Discovery | Not time-bound | 15 per section | 100 | Every answer reports how many rows it read and how many FireHydrant matched. When those differ, ask for more rows (up to 100) or a shorter window before treating the answer as complete. There's no paging past 100 rows, so narrow the window instead, for example `List FireHydrant incidents from the last 30 days, up to 100 rows`. ### Verify the connection ```text theme={null} Run FireHydrant discovery and summarize the organization, the severity names this account uses, and how many services and teams you can read ``` A working connection names your organization and lists your severities, such as `SEV1` and `SEV2`. An error such as "FireHydrant rejected the API key" means the key needs replacing. ### Example prompts ```text theme={null} List the FireHydrant incidents that are still open, with severity and impacted services Which Signals alerts fired in the last 24 hours and never became an incident? Which team owns the checkout service in FireHydrant, and does it have an active incident? Summarize FireHydrant incidents from the last 30 days by severity and impacted service ``` ## Troubleshooting > [accordion] FireHydrant rejected the API key > > FireHydrant answered `401`. The key was copied incompletely or revoked. Create a new key in **Settings → API Keys**. In CloudThinker, open FireHydrant in **More → Workspace settings → Connections**, click the pencil icon on the account's row, click **Replace…** in **Edit Instance**, paste the key, and click **Save and test**. > [accordion] FireHydrant accepted the key but refused the request > > FireHydrant answered `403`. Because keys are always Owner-level, this isn't a permissions problem. Check that the key still exists in **Settings → API Keys**. If it's gone, create a new one and replace it in CloudThinker. If the key is there, the organization's account may be suspended: contact FireHydrant support. > [accordion] FireHydrant rate-limited the test > > FireHydrant answered `429`. Its limit is 50 requests every 10 seconds, shared by every API key in the organization, so another integration can use it up. Wait a minute and test again. > [accordion] Could not reach the FireHydrant API > > CloudThinker couldn't connect to FireHydrant at all. Check FireHydrant's status, then connect again. > [accordion] A filtered question returns nothing > > FireHydrant returns an empty list, not an error, for a severity, priority, or team name your account doesn't use. Ask the agent to run discovery first, then repeat the question with the exact names it returns, such as `SEV1` instead of `SEV-1`. ## Security * **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later. * **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection. * **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection. * **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves. - **Owner-level key.** Keep it out of chat and repositories, paste it only into the connection dialog, and delete it in FireHydrant when you remove the connection. - **Rotate without downtime.** Create a new key in FireHydrant, replace it in CloudThinker (pencil icon → **Replace…** → **Save and test**), and delete the old key once the test passes. See [Rotate a credential](https://docs.cloudthinker.io/guide/connections/overview.md#rotate-a-credential). - **Read-only by design.** CloudThinker only reads from FireHydrant on this connection, so a mistaken prompt can't change an incident. - **Shared rate limit.** Every integration on your FireHydrant organization shares one rate limit. Agents run one read at a time to stay under it. ## Related > [card] [Resolve](https://docs.cloudthinker.io/guide/incident/overview.md) > > Investigate incidents and find the root cause with CloudThinker > [card] [Rootly Connection](https://docs.cloudthinker.io/guide/connections/rootly.md) > > Triage incidents and review alerts in Rootly This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.