Notifications

22 subscribable event types across Email, Slack, and Microsoft Teams. Per-event templates with Go variables, delivery via the job queue, and per-project routing.

Event catalog

Every notifiable event has a stable name. Subscribe channels to event names with optional severity filters.

Event	Fires when
`cert.issued`	A certificate is issued for the first time.
`cert.renewed`	A renewal completes successfully.
`cert.renewal_failed`	A renewal attempt fails.
`cert.expiring_soon`	A certificate crosses the expiry warning window.
`cert.expired`	A certificate has expired.
`cert.revoked`	A certificate is revoked from CertAutoPilot.
`cert.revocation_detected`	The CA revoked a certificate out-of-band (detected by the revocation sweep).
`distribution.success`	A distribution completes successfully (one event per distribution, including fan-out).
`distribution.failed`	A distribution fails or completes partially.
`distribution.rollback_success`	A distribution rollback succeeds.
`distribution.rollback_failed`	A distribution rollback fails (or cannot be enqueued).
`job.failed`	A background job exhausts its retries.
`domain.expiring_soon`	A tracked domain registration is close to expiry.
`domain.expired`	A tracked domain registration has expired.
`domain.dangling_dns`	DNS for a tracked domain points at a resource that no longer exists (takeover risk).
`domain.dnssec_missing`	A tracked domain has no DNSSEC at the registrar.
`domain.no_dmarc`	A tracked domain has no DMARC policy.
`approval.requested`	An operation requiring approval is requested.
`approval.approved`	An approval request is approved.
`approval.rejected`	An approval request is rejected.
`approval.executed`	An approved operation is executed.
`approval.expired`	An approval request expires unanswered.

Discovery events

Discovery surfaces its results as findings rather than notification events. discovery.* event constants exist in the codebase but are not currently emitted and cannot be subscribed to in rules.

Channels

Configure under Settings → Notifications → Channels.

Email — SMTP host, port, STARTTLS / TLS, auth. Per-recipient lists.
Slack — incoming webhook URL or Bot OAuth token.
Microsoft Teams — Workflow URL (Power Automate) or legacy connector.

Toggling a channel off stops all delivery through it — rules pointing at a disabled channel are skipped (recorded in History as channel is disabled), even if the rules themselves stay enabled.

Templates

Each event has a built-in default template; org-level custom templates can override it per channel type. Variables are exposed via Go templating as flat, pre-formatted strings — for example:

Subject: Certificate Expiring Soon: {{.primary_domain}}

<p>Certificate <b>{{.primary_domain}}</b> is expiring soon.</p>
<p>Expires: {{.expires_at}}</p>
<p>Certificate: {{.certificate_id}}</p>

{{.event_type}}, {{.certificate_id}}, and {{.job_id}} are available on every event; the rest ({{.primary_domain}}, {{.error}}, {{.expires_at}}, {{.domain_name}}, …) vary per event. No template functions are registered, and missing variables render as empty strings. Custom templates are per channel type (email HTML vs Slack/Teams plain text). See Notification templates for the full per-event variable reference.

Routing

A rule binds one or more event types to a channel:

Severity at least (severity_min) — e.g. warning filters out info noise.
Project — rules are project-scoped; a rule only matches events from its project.
Recipients — per-rule recipient override for email channels.
Message Template (optional) — a specific template to render this rule's events. Leave empty to use the channel's default / built-in per-event message. Its channel type must match the rule's channel. Assigning different templates to different rules is how you get different messages for different events.

Multiple rules can match the same event; each fires independently (so avoid unintended overlap). A rule listing several events renders one template for all of them — split into separate rules, or guard event-specific variables with {{if}}, when the messages should differ.

Delivery & retries

Each matched rule enqueues a notification.send job. Delivery is retried by the job queue (up to 3 attempts with backoff); after the final failure the job is marked failed. Sent and failed deliveries surface under Settings → Notifications → History with their status and last error — there is no separate dead-letter buffer beyond the job queue itself.

Testing a channel

Each channel has a Send test button — fires a fixture event and reports the channel's response. Always click it after creating or editing a channel.

Event catalog​

Channels​

Templates​

Routing​

Delivery & retries​

Testing a channel​

See also​