Skip to main content

Contact groups & channels

Contact groups are named recipient lists per workspace. Each token or agent delivers alerts to its assigned contact groups, or to the workspace default group when none are assigned. You can assign one or more groups per asset (multi-group is on by default). For a given threshold window, only groups whose effective thresholds include that window receive that alert; recipients and channels are the union of those matching groups. Groups combine per-contact channels (email, WhatsApp), named webhooks, and an optional thresholds override.

  • Per-contact channels: select Email and/or WhatsApp for each contact from the workspace contacts list. Email uses the contact's email; WhatsApp uses the contact's phone number.
  • Webhooks: select named webhooks from the workspace webhook list.
  • Thresholds override: optionally set group-specific thresholds that override workspace defaults for that group. When a token has multiple groups, alert windows are the union of each group's effective thresholds; delivery for each window still goes only to groups that include that window.
  • Default group: set a workspace default; tokens and agents without an explicit assignment use the default.
  • Per-token / per-agent assignment: assign one or more contact groups when creating or editing a token or agent.
  • Overlap: a person or webhook in more than one assigned group still gets one live alert and one weekly digest for the unioned assets, not one message per group.
  • Caps: contact groups per workspace and members per group are capped per plan. See Plan limits.

Multiple groups per asset​

Multi-group assignment is on by default for tokens, certificates, and CLM agents. GET /api/auth/features reports contactGroupPluralWrites (on when CONTACT_GROUP_PLURAL_WRITES is unset or empty; set false only to 400 two-or-more contact_group_ids on a 0.16 replica).

  • Control Center eligibility uses the same union of thresholds and channels as discovery.
  • On the API and in file import, write and read contact_group_ids. Legacy contact_group_id still works and returns the lexicographically smallest assigned group, or null when the asset uses the workspace default.
  • Generic HTTPS digest webhooks keep contact_group and add contact_groups (array of contributing group names).

Workspace contacts​

Contacts are people who can receive alerts. Add them once per workspace, then select them in contact groups.

  • Add contacts: first name, last name, and at least a valid email or E.164 phone number (for example +14155550100). Optional details: department, title, note.
  • Test contacts: use the Test button to send a test WhatsApp message (2-minute cooldown per number).
  • Select in groups: in the contact group editor, check which contacts should receive alerts and on which channels.

WhatsApp​

WhatsApp is hosted; you do not configure a provider. Available on all plans. Add workspace contacts with phone numbers, then select them in contact groups.

  • No fallback: if a contact group has no contacts selected for WhatsApp, WhatsApp alerts are not sent.
  • Monthly caps and per-minute throttles apply per organization across all workspaces. See Plan limits.

Webhooks​

Webhooks are available on Pro and Team plans. Webhooks deliver alerts to Slack, Microsoft Teams, Discord, PagerDuty, or any generic HTTPS endpoint.

  • Named webhooks: create each webhook once with a required name, then reference it from one or many contact groups. Up to 5 webhooks per workspace.
  • Provider host validation: for the Slack, Teams, Discord, and PagerDuty kinds, the URL host must belong to the official provider domain (for example hooks.slack.com, Teams Workflows / Power Automate hosts such as *.environment.api.powerplatform.com and *.logic.azure.com, legacy webhook.office.com/office365.com, discord.com, events.pagerduty.com); other hosts are rejected with WEBHOOK_HOST_NOT_ALLOWED. Use the generic kind for any other HTTPS endpoint.
  • Verification: webhooks are verified with a test delivery before use. Test sends are rate limited (a few per minute with a short cooldown between attempts).
  • Retry: failed webhook deliveries appear in the alert queue and can be retried from there.

Slack​

Create an incoming webhook in your Slack workspace and paste the https://hooks.slack.com/services/... URL. TokenTimer sends Slack-formatted messages with the token name, workspace, expiry date, and days remaining.

Microsoft Teams​

Create the webhook with the Workflows app in Teams: open ... (More options) on the target channel, choose Workflows, and use the Post to a channel when a webhook request is received template (or build a Power Automate flow with the When a Teams webhook request is received trigger). Paste the generated https://...environment.api.powerplatform.com/... URL. TokenTimer sends a Teams-compatible card with the token details.

Classic Office 365 incoming webhook connectors (webhook.office.com URLs) were retired by Microsoft in May 2026 and no longer deliver messages; recreate any remaining ones with the Workflows app and update the webhook URL in TokenTimer.

Discord​

Create a webhook in the channel settings (Integrations → Webhooks) and paste the https://discord.com/api/webhooks/... URL. TokenTimer sends a Discord-formatted embed with the token details.

PagerDuty​

Use a PagerDuty Events API v2 integration key (a 32-character alphanumeric routing key). TokenTimer triggers an event with the token name and expiry details so your escalation policies take over. PagerDuty is not supported for weekly digests.

Generic HTTPS endpoint​

Any HTTPS endpoint can receive alert deliveries as JSON with the generic kind (the provider host validation above applies only to the named kinds). Use this for internal tooling, automation, or chat systems not listed above.

Weekly digest payloads on the generic kind keep contact_group and add contact_groups. See Weekly digest.