This is the complete set of variables available inside a webhook Handlebars template. They mirror the canonical payload one-to-one, so anything you see in the default body, you can interpolate. Use dot-notation for nested fields: {{monitor.name}}, {{incident.status}}.
The dashboard ships the same list behind the Insert variable popover on the channel form, and the live preview renders against the example values below. This page is the standalone reference for the same set.
incident.opened event. On other events some fields shift: incident.resolved_at and incident.duration_sec populate on resolve, incident and check are null on a test event. The per-event behavior is documented field-by-field on the Payload page.
Top level
event is one of incident.opened, incident.acknowledged, incident.resolved, incident.escalated, incident.flapping, monitor.paused, monitor.resumed, or test.
org
The workspace that owns the monitor.
monitor
The monitor the event is about. Always present, even on a test event (a synthetic demo monitor).
monitor.type is one of http, tcp, ping, dns, ssl, keyword, heartbeat. monitor.url is present only for http and keyword monitors; it renders empty for the others.
incident
The incident this event belongs to. Present on every incident.* event; null on test. Reference its fields without guarding only when you know the event carries an incident.
incident.status is one of open, acknowledged, resolved. Region codes are fra1, iad1, hil1, sgp1, syd1, gru1. failing_regions is empty on resolve, since every region agrees the monitor is back up.
check
The latest probe behind the event. Present on incident events; null on test.
last_error_class is a stable category like timeout, dns_resolve, tls_cert_invalid, or http_status. Both error fields are null on resolve.
Usage examples
Handlebars renders a missing value as an empty string, so a field that’s null (like incident.resolved_at on an open event) interpolates to nothing rather than the literal null. Branch on it instead of comparing strings:
That renders [OPEN] API production and fra1, iad1, sgp1 for the sample event above.
There’s no {{event}} equality helper, so guard on the field that distinguishes the case. incident and check are null on a test event, so a #if on either short-circuits cleanly:
See Templates for full worked examples (Slack, Datadog, Statuspage) and the escaping caveats. 
