PagerDuty
Proofroom reads PagerDuty’s REST API with a read-only key. It collects who was on call, incident timelines, and, for every major incident, opens a Workflow task asking for its post-incident review.
What each collector shows
| Collector | Kind | Default cadence | What it shows | Suggested controls |
|---|---|---|---|---|
| On-call schedule | window | quarterly | Who was on call on every schedule through the period, after overrides, and any gaps in coverage. | PCI DSS 12.10.3; SOC 2 CC7.4 |
| Incident timelines | window | monthly | Incidents created in the period with when each was acknowledged and resolved, and its log. | PCI DSS 12.10.1; SOC 2 CC7.4, CC7.5 |
| Post-incident reviews | window | monthly | Major incidents resolved in the period, each with a Workflow task asking for its review. | PCI DSS 12.10.6; SOC 2 CC7.5 |
Post-incident reviews. PagerDuty has no API for the review document on any plan. For each major incident resolved in the period, Proofroom opens a one-off Workflow task, due a set number of days after the incident was resolved, asking its owner to export the review as a PDF (Incidents → Post-Incident Reviews → open the review → PDF) and upload it. The task is opened once per incident. An incident is major when its priority is one you list (P1 and P2 by default); if your account does not use priorities, high-urgency incidents count as major and the evidence says so. Follow-up actions synced to Jira are covered by the Jira connector. Legacy Jeli reviews are not read (Jeli closes on 22 December 2026).
Create the key
An Admin or the Account Owner: Integrations → API Access Keys → Create New API Key, tick Read-only API Key, and copy the key. Read-only keys can make only GET calls, which is all Proofroom does. Some accounts on legacy pricing plans have no REST API.
Connect
| Field | Value |
|---|---|
| Region | us or eu (accounts on app.eu.pagerduty.com) |
| API key | The read-only key |
| Major priorities | Priority names that make an incident major, one per line (default P1, P2) |
| Review due days | Days after resolution that a review is due (default 14) |
| Review owner | Email of the Proofroom user who owns the review tasks; blank leaves them waiting for an owner |
| Review reviewer | Email of the Proofroom user who reviews the uploads (optional) |
The connection test signs in with /abilities, lists schedules, reads the last day’s incidents and checks that
every major priority you list is one of the account’s priority names (exact spelling and case). The incident
timelines and post-incident reviews runs check the same: a name that matches none of the account’s priorities would
mark no incident major and ask for no reviews, so the run fails naming it instead. An account with priorities turned
off, or not on its plan, is not checked: high-urgency incidents count as major.
Known limits
- Schedules are rendered month by month and joined.
- PagerDuty pages no further than 10,000 records; a month with more incidents fails the run.
- A task’s owner and reviewer can be changed on the task’s page; its dates cannot.