Victorops

Documentation covers the REST endpoint format clearly with the expected payload fields and state types. Teams migrating from VictorOps's legacy documentation to the Splunk On-Call documentation should note the rebranding. For agents posting alerts into existing VictorOps deployments, the REST endpoint documentation is the primary integration reference.

VictorOps (now Splunk On-Call) is an on-call and incident management platform with a significant installed base in Splunk-centric operations teams. For agents working alongside existing Splunk observability infrastructure, VictorOps integration keeps incident creation within the established operations toolchain. The REST endpoint integration accepts alert payloads from external systems including agents, routing them through configured escalation policies to the appropriate on-call team.

Authentication for the REST endpoint uses the endpoint URL token embedded in the URL — no additional auth header is required. The full REST API uses API ID and API key authentication. Teams should treat the endpoint URL as a credential since it directly controls incident creation routing.

The primary integration surface is the REST endpoint — a per-integration URL that accepts incident payloads via HTTP POST. Agents POST alert data (entity ID, state, message, monitoring tool) to the endpoint, and VictorOps routes the incident through configured policies. The full REST API covers teams, schedules, incidents, and reporting for management operations. The REST endpoint is simpler for alert creation than the full API, requiring only the endpoint URL and payload format.

Reliability is appropriate for production on-call infrastructure. VictorOps/Splunk On-Call maintains the delivery guarantees required for incident notification. Teams integrating agents with Splunk observability infrastructure will find the VictorOps integration consistent with the broader Splunk ecosystem reliability.