HTTP triggers in Azure SRE Agent

HTTP triggers in Azure SRE Agent are webhook endpoints that external systems use to invoke your agent on demand. When a continuous integration and continuous delivery (CI/CD) pipeline fails, an alerting tool detects an anomaly, or any HTTP client sends a POST request, the agent receives the event context and starts working immediately.

The problem: Alerts and pipeline failures need manual triage

Your team already has alerting, observability, and workflow tools like Datadog, Dynatrace, Jira, Splunk, and Grafana, and CI/CD pipelines that break. When something goes wrong, the response is the same every time:

• An engineer gets paged: The engineer opens the monitoring tool, reads the alert, and then manually opens logs, metrics, and deployment history across multiple dashboards to figure out what happened.
• A pipeline fails: Someone has to stop what they're doing, check the build output, correlate with recent changes, and decide whether to roll back or fix forward.
• Context is scattered: The Datadog alert says, "CPU spike on prod-api." The root cause requires correlating logs from three services, checking recent deployments, and reviewing Dynatrace traces.

How HTTP triggers work

HTTP triggers let you connect any tool that supports webhooks directly to your instance of SRE Agent. Instead of an engineer doing manual triage, the system that detected the problem, whether it's a Datadog alert, a Dynatrace anomaly, a Jira workflow transition, or a pipeline failure, tells the agent to investigate. The context is passed along automatically.

Each trigger is a named webhook endpoint on your agent with a unique URL. When an external system calls that URL via HTTP POST, the agent executes the trigger's configured prompt, which is enriched with any JSON data in the request body.

Key concepts

Invoke a trigger

Call the trigger URL with an HTTP POST request:

curl -X POST \
  https://your-agent.sre.azure.com/api/v1/httptriggers/trigger/<TRIGGER_ID> \
  -H "Authorization: Bearer <ARM_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "source": "datadog",
    "alert_title": "High error rate on checkout-api",
    "severity": "critical",
    "service": "checkout-api",
    "region": "eastus2",
    "metric": "error_rate",
    "value": "8.2%",
    "threshold": "5%"
  }'

The JSON body is optional. If you call the trigger without a body, the agent runs with only the trigger's configured prompt. With a body, the agent sees both the prompt and the data that you sent.

Authentication for trigger invocation

The trigger endpoint requires an Azure Resource Manager Bearer token in the Authorization: Bearer <TOKEN> header. The caller needs Microsoft.App/agents/threads/write permission on the agent resource.

Ways to obtain a token

Connect external tools that don't support Azure authentication

Tools like Datadog, Dynatrace, Jira, and Splunk send webhooks with their own authentication formats, not Azure Resource Manager tokens. To bridge the gap, use one of the following intermediaries.

Response

{
  "message": "HTTP trigger execution initiated",
  "executionTime": "2026-03-13T10:30:00Z",
  "threadId": "thread-abc123",
  "success": true
}

The trigger returns HTTP 202 (Accepted) immediately. The agent processes the request asynchronously.

What makes this approach different

HTTP triggers connect your existing alerting and CI/CD tools directly to your agent without an engineer in the loop. The system that detected the problem tells the agent to investigate and passes along the full context automatically. There's no paging, no dashboard switching, and no manual context gathering.

Before and after

Scheduled tasks vs. HTTP triggers

Use both together. Use scheduled tasks for proactive monitoring and HTTP triggers for reactive event handling.

Use cases

CI/CD pipeline integration

When a deployment pipeline fails, invoke the agent to analyze the failure:

# In your pipeline's failure handler
curl -X POST "$AGENT_TRIGGER_URL" \
  -H "Authorization: Bearer $ARM_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"pipeline\": \"$PIPELINE_NAME\", \"run_id\": \"$RUN_ID\", \"error\": \"$ERROR_MESSAGE\"}"

Alert-driven investigation

Connect your alerting system to trigger automated investigation when critical alerts fire:

{
  "alert_name": "Error rate > 5%",
  "severity": "P1",
  "service": "checkout-api",
  "region": "eastus2",
  "start_time": "2026-03-13T10:15:00Z"
}

Deployment compliance checks

After a deployment completes, trigger a compliance review:

curl -X POST "$AGENT_TRIGGER_URL" \
  -H "Authorization: Bearer $ARM_TOKEN" \
  -d '{"deployment_id": "deploy-456", "environment": "production", "changes": ["config update", "image bump"]}'

API reference

Troubleshooting

Trigger returns 404

• Verify that the trigger is set to enabled. Disabled triggers return 404.
• Check that the trigger ID in the URL is correct.

401 Unauthorized

• The token audience must match the SRE Agent app ID, not https://management.azure.com.
• To get a token for testing, use az account get-access-token --resource 59f0a04a-b322-4310-adc9-39ac41e9631e --query accessToken -o tsv.

Trigger executes but the agent doesn't act

• Check the agent prompt. An empty prompt might not produce useful output.
• Verify that the chosen subagent has the tools needed for the task.
• Check the execution history for error details.

Limits

Related content

• Scheduled tasks
• Workflow automation
• Create and test an HTTP trigger