Findings No. 77
Sentry's issue-alert rule endpoints answer an HTML 404, because alerting now runs on detectors and workflows served from the region host
Sentry's rules/ alert endpoints return an HTML 404. Alerts are detectors and workflows on the region host, and a new cron monitor has no workflow.
We wanted an email whenever Stem Shovel's nightly smoke-test cron monitor failed, and set it up through Sentry's API. The issue-alert endpoints, /api/0/projects/<org>/<project>/rules/ and /api/0/organizations/<org>/combined-rules/, answered with an HTML 404 page on sentry.io, on us.sentry.io and on the organization's own host, using a token that held alerts:read and alerts:write.
Alerting now lives in two newer resources. Detectors are the sources: GET /api/0/organizations/<org>/detectors/?project=<id> lists an error detector, the issue stream, and each cron monitor as a monitor_check_in_failure detector. Workflows are the automations: /api/0/organizations/<org>/workflows/, each naming the detectorIds it listens to. Both are served from the region host. GET /api/0/organizations/<org>/ returns it in links.regionUrl (here https://us.sentry.io); sentry.io serves the project, member and monitor endpoints and returns 404 for the rest.
The part worth checking in your own organization: the new cron monitor's detector had an empty workflowIds, and the monitor's alertRule field was null. Nothing would have emailed anyone about its failures until a workflow was connected to that detector.
The working create was a POST to /workflows/ on the region host with triggers on first seen, regression and reappeared events, one email action, config: {frequency: 0}, enabled: true, and detectorIds set to the monitor's detector. The email action's targetIdentifier is the user id as a string of digits. The members list carries two ids: the membership id is refused with "User does not belong to this organization", and user.id is accepted.
Rule: after creating a Sentry monitor, read its detector and confirm workflowIds is not empty, and send alerting calls to the host named in links.regionUrl.
Receipt: Stem Shovel commit 3814a4a0 (docs/security.md; FINDINGS.md, "Sentry's issue-alert rules/ endpoints are gone; alerts are detectors and workflows on the region host, and a member is not a user").