n8n
Alerts in. Automation out.Sentinel and n8n, both directions
Every incident lands in an n8n Webhook node as structured JSON, and any workflow can read or change your monitors through the API. Two workflows to import, nothing to install.
Sentinel → n8n
Why n8n
The automation tool self-hosters already run
n8n is where ops teams who would rather host their own automation build it. Sentinel fits on both ends of a workflow: an incident arrives as a webhook and starts one, and the REST API lets any workflow read or change monitors along the way.
There is nothing to install inside n8n. The Webhook, IF, HTTP Request and Code nodes ship with it, so the two workflows below import into n8n Cloud or a self-hosted instance exactly as they are. Swap the Slack node at the end for whatever you actually use.
- Webhook node receives every incident and recovery as JSON
- Header Auth credential matches Sentinel's custom header auth
- HTTP Request node reads and writes through the REST API
- Webhook alerts on Pro and above, the API on every plan
Sentinel incident to Slack · active
Webhook
POST /sentinel
Header Auth
IF
event =~ /down|failed|missed/
true
Post outage
false
Post recovery
Last execution · 12:51:12
"event": "monitor.down" → true → #ops
Features
Two ends of a workflow
Incidents as a Webhook node
Sentinel posts each incident and recovery to n8n's Webhook node as JSON: the event, the monitor, what failed and why, which regions confirmed it, and deep links back to the evidence.
Header auth on both sides
Sentinel's custom header auth and n8n's Header Auth credential are the same handshake. Set one token on each side and the node rejects anything that doesn't carry it.
Branch on the event name
One IF node splits outages from recoveries. Send outages to a pager or a ticket queue and recoveries to a channel, or open and close the same ticket from the two branches.
Read Sentinel from any workflow
An HTTP Request node with a Bearer token reaches the whole REST API: monitors, incidents, uptime, team members, status pages and webhook deliveries.
Create and pause monitors from workflows
A new client in your CRM can become a monitor in the same run. A deploy pipeline can pause a monitor before it ships and resume it after, through the same API the dashboard uses.
Access reviews on a schedule
A Schedule Trigger pulls your team roster with role, MFA state and last sign-in, and posts who needs a look. The evidence an auditor asks for, collected without anyone logging in.
Workflows to import
Two workflows, ready to import.
Download the file, then in n8n open the workflow menu and choose Import from File. Each one needs a credential or two on your side, and the setup guide walks through them.
Webhook · IF · Slack
Incident to Slack
Sentinel posts an incident, the IF node tells an outage from a recovery by the event name, and Slack gets a red message with the root cause, the confirming regions and a link to the incident, or a green one when it clears.
Download sentinel-incident-to-slack.jsonSchedule · HTTP Request · Code · Slack
Weekly access review
Every Monday morning the workflow pulls your team members from the API, flags anyone without MFA or without a sign-in in 90 days, and posts the list. Change the schedule to nightly if your auditor wants daily evidence.
Download sentinel-access-review.jsonIs there a Sentinel node for n8n?
Not today. Both workflows on this page use nodes that ship with n8n (Webhook, IF, HTTP Request, Code and Slack), so there is nothing to install and they work on n8n Cloud and self-hosted alike. A dedicated node would mostly save typing the API URL.
How do I secure the webhook?
Use header auth on both sides. In Sentinel, add the webhook with the Custom header auth type, a header name such as X-Sentinel-Token, and a token. In n8n, create a Header Auth credential with the same name and value and set the Webhook node's authentication to Header Auth. Sentinel can also sign each payload with HMAC-SHA256 if you add a signing secret, for workflows that want to verify in a Code node instead.
Does this work with self-hosted n8n?
Yes. The Webhook node needs a URL Sentinel can reach over HTTPS, so an n8n on a private network needs a reverse proxy with TLS or a tunnel in front of it. The workflow files are identical for n8n Cloud.
Which plans include it?
The incident trigger uses outbound webhooks, which are included on the Pro plan and above. The API half works on every plan, including Free, with an API token whose permissions you choose when you create it.
Which events arrive at the Webhook node?
Outages and recoveries (monitor.down and monitor.up), plus the same pairs for ping, port, heartbeat, keyword, JSON assertion and agent payment checks. Each webhook endpoint picks which severities it hears about, and every monitor's own notification routing can opt out of webhooks.
Can an n8n workflow create or pause monitors?
Yes. POST to /api/v1/monitors to create one, and POST to /api/v1/monitors/{id}/pause or /resume around a deploy. The token needs the matching create or update permission. The API docs list every endpoint with its fields.
Put Sentinel in your workflows
Import a workflow, add a webhook on the Pro plan, and the next incident starts an automation.
No card for the free plan · 14-day trial on paid plans · Cancel anytime