Notification Channels

JITSudo sends notifications through configured channels when access request lifecycle events occur.

Supported Events

Event	Description
request.pending	New request submitted, awaiting review
request.approved	Request approved
request.denied	Request denied
request.expired	Approval timeout reached
request.break_glass	Emergency break-glass access used
grant.active	Grant provisioned, access is live
grant.expiring_soon	Grant nearing expiration
grant.expired	Grant expired
grant.revoked	Grant revoked

Channel Types

Slack Webhook

curl -X POST https://jitsudo.example.com/v1/notification-channels/slack-webhook \
  -H "X-API-Key: <api-key>" \
  -H "X-Tenant-ID: <tenant-uuid>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "engineering-slack",
    "webhook_url": "https://hooks.slack.com/services/T.../B.../xxx",
    "event_filters": ["request.pending", "request.approved", "grant.active"]
  }'

Email (SMTP)

curl -X POST https://jitsudo.example.com/v1/notification-channels/email \
  -H "X-API-Key: <api-key>" \
  -H "X-Tenant-ID: <tenant-uuid>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "security-team-email",
    "smtp_host": "smtp.example.com",
    "smtp_port": 587,
    "from_address": "jitsudo@example.com",
    "to_addresses": ["security@example.com"]
  }'

Generic Webhook

curl -X POST https://jitsudo.example.com/v1/notification-channels/generic-webhook \
  -H "X-API-Key: <api-key>" \
  -H "X-Tenant-ID: <tenant-uuid>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "pagerduty-webhook",
    "url": "https://events.pagerduty.com/integration/xxx/enqueue",
    "headers": {"Authorization": "Token token=xxx"}
  }'

AWS SNS

curl -X POST https://jitsudo.example.com/v1/notification-channels/aws-sns \
  -H "X-API-Key: <api-key>" \
  -H "X-Tenant-ID: <tenant-uuid>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ops-sns-topic",
    "topic_arn": "arn:aws:sns:us-east-1:123456789012:jitsudo-notifications"
  }'

Event Filtering

Each channel can specify event_filters — an array of event types to subscribe to. An empty array (or omitted) means all events are delivered.

Notification Processing

Notifications are processed asynchronously by the NotifyWorker:

• Non-blocking — notification failures don’t affect request processing
• Retries up to 3 times on failure
• Deduplication by payload with a 2-hour window