Notification channels and delivery

MoleSignal separates provider credentials from recipients and routing. Configure a connector once, bind identities or fallback targets, and then choose when the notification engine uses those routes.

Resource	Purpose
Connectors	Store organization-level provider credentials and transport settings.
User routing	Bind provider identities and order personal delivery endpoints.
Policies	Match events, resolve recipients, select templates, and control escalation.
Templates	Reuse text, Markdown, or HTML message bodies.
Fallback routes	Define ordered team and organization targets after personal delivery fails.
Delivery log	Inspect attempts, latency, errors, retries, acknowledgement, and escalation.

Supported connectors

Connector	Configuration	Supported targets
Email SMTP (`email_smtp`)	SMTP host, port, credentials, sender, TLS mode, timeout	User or fixed email address
Slack app (`slack_app`)	Bot token, app-level token, client ID and secret, Slack API base URL, timeout	Slack user ID or channel ID
Slack webhook (`slack_webhook`)	Incoming webhook URL, timeout	Configured webhook or per-target webhook URL
Lark app (`lark_app`)	App ID, app secret, API base URL, recipient ID type, timeout	User identity, email address, or chat ID
Lark webhook (`lark_webhook`)	Custom bot webhook URL, optional signing secret, timeout	Configured webhook or per-target webhook URL
DingTalk app (`dingtalk_app`)	Client ID and secret, optional robot code, API base URL, timeout	DingTalk user ID or `openConversationId`
DingTalk webhook (`dingtalk_webhook`)	Custom robot webhook URL, optional signing secret, timeout	Configured webhook or per-target webhook URL
WeCom app (`wecom_app`)	Corp ID, app secret, AgentId, API base URL, timeout	Member user ID or app chat ID
WeCom webhook (`wecom_webhook`)	Group robot webhook URL, timeout	Configured webhook or per-target webhook URL
WeCom smart bot (`wecom_bot`)	Bot ID, long connection secret, long connection address	None: it only lets Mole Agent answer in IM
Microsoft Teams bot (`teams_app`)	App ID, client secret, tenant ID, service URL, timeout	User ID or conversation ID
Microsoft Teams webhook (`teams_webhook`)	Channel webhook URL, timeout	Configured webhook or per-target webhook URL
Google Chat app (`google_chat_app`)	Service account key (JSON), optional Pub/Sub subscription, API base URL, timeout	User (`users/…`) or space (`spaces/…`)
Google Chat webhook (`google_chat_webhook`)	Space webhook URL, timeout	Configured webhook or per-target webhook URL
Alibaba Cloud voice (`aliyun_voice`)	AccessKey, text-to-speech template code, optional caller ID, title and text variables, variable length limit, times read, API base URL, timeout	Number in mainland China
Alibaba Cloud SMS (`aliyun_sms`)	AccessKey, signature, template code, title and text variables, variable length limit, API base URL, timeout	Mainland or international number
Twilio voice (`twilio_voice`)	Account SID, auth token, calling number, language, optional voice, times read, API base URL, timeout	E.164 number
Twilio SMS (`twilio_sms`)	Account SID, auth token, sender, API base URL, timeout	E.164 number
AWS voice (`aws_voice`)	Region, authentication, origination identity, optional Polly voice, times read, optional API URL, timeout	E.164 number
AWS SMS (`aws_sms`)	Region, authentication, optional origination identity, optional API URL, timeout	E.164 number
Webhook (`webhook`)	Default URL, HTTP method, headers, timeout	User, address, group, or per-target webhook URL

All connector timeouts must be between 1 and 60 seconds. URLs must be absolute http or https URLs.

Create and test a connector

Viewing connectors requires alerts.read. Creating, editing, testing, enabling, disabling, or deleting connectors requires alerts.manage.

Open notification management

Go to Settings → Notify → Connectors.

Choose a provider

Click New connector, enter a unique name, and select the connector type. Connector type cannot change after creation.

Enter provider settings

Add the credentials and transport settings described below. Keep Allow this connector to deliver enabled unless preparing the connector for later use.

Save the connector

Click Save connector. MoleSignal encrypts the complete configuration at rest. API responses replace sensitive values with ***.

Send a test

Edit the saved connector, select a compatible target type, enter a real target, and click Test connection. The connector status changes to Connected or Error based on the latest test.

Save a new connector before testing. During connector edits, leave a masked *** value unchanged to preserve the stored secret.

Configure each provider

Email SMTP

Enter the SMTP host, port, username if required, password, and a valid From address. Choose one of these TLS modes:

TLS mode	Suitable use
`none`	The SMTP connection does not use TLS. Avoid this on untrusted networks.
`starttls`	The server upgrades the connection with STARTTLS, commonly on port `587`.
`tls`	The connection starts with TLS, commonly on port `465`.

Use fixed_address or direct_user for the test target and enter a valid mailbox such as [email protected].

Slack app

Create a Slack app with a bot token that can call chat.postMessage. Add the bot to each channel where notifications must be sent. Enter:

Bot token — the bot token, normally beginning with xoxb-;
App-level token — optional; a token beginning with xapp- with the connections:write scope, which lets Mole Agent answer in Slack over Socket Mode. See Mole Agent in IM;
API base URL — keep https://slack.com/api unless a compatible proxy is configured;
Client ID and Client secret — from Basic Information of the Slack app, for status pages whose visitors add the page to their own Slack channels. See Status pages;
Timeout — a value from 1 to 60 seconds.

The connector needs the bot token, the client ID and secret, or all three. Notifications need the bot token. The client secret, like the bot token, is kept encrypted with the connector and is never returned. Use a Slack member ID for direct_user or a channel ID for fixed_group. The value must not contain whitespace. A display name such as #alerts is not a channel ID. Once the connector is turned on under Mole Agent → Settings → IM, alert notifications sent through it carry Acknowledge and Resolve buttons. See Alert cards.

Slack webhook

Create an incoming webhook in Slack and copy the URL into Webhook URL. A fixed_group target uses this configured URL. A webhook target treats the target value as an alternate URL for that delivery. MoleSignal sends a JSON object with a text field. Any non-2xx response marks the attempt as failed.

Lark app

Create a tenant app that can obtain a tenant access token and send messages. Enter the App ID and App secret. Keep the default API base URL unless another compatible Lark endpoint is used. The selected recipient ID type applies to direct_user targets:

Target type	Value
`direct_user`	`open_id`, `user_id`, `union_id`, or email, according to Recipient ID type
`fixed_address`	Email address; MoleSignal sends with `receive_id_type=email`
`fixed_group`	Lark chat ID; MoleSignal sends with `receive_id_type=chat_id`

With events received over a long connection, the app also lets Mole Agent answer in Feishu. See Mole Agent in IM. Once the connector is turned on under Mole Agent → Settings → IM, alert notifications sent through it carry Acknowledge and Resolve buttons. See Alert cards.

Lark webhook

Copy the custom bot URL into Webhook URL. If bot signature verification is enabled, also enter the Signing secret. MoleSignal generates the timestamp and HMAC-SHA256 signature for every request. A fixed_group target uses the configured URL. A webhook target can override the configured URL with another absolute URL. See Webhook connectors for the request and signature format.

DingTalk app

Use the robot of an internal DingTalk app. Enter the app’s Client ID and Client secret. Leave Robot code empty unless the robot has a code of its own; it then is the Client ID. MoleSignal exchanges the credentials for an access token and sends Markdown messages through the robot.

Target type	Value
`direct_user`	DingTalk user ID (`userId`) of a person in the app’s visible range
`fixed_group`	The `openConversationId` of a group the robot is in

With its messages received over Stream mode, the robot also lets Mole Agent answer in DingTalk. See Mole Agent in IM.

DingTalk webhook

Copy the custom robot’s URL into Webhook URL. If the robot signs requests, also enter the Signing secret: MoleSignal adds the timestamp and HMAC-SHA256 signature to every request. A fixed_group target uses the configured URL; a webhook target replaces it.

WeCom app

Use a self-built WeCom app. Enter the Corp ID, the app’s Secret, and its AgentId. MoleSignal exchanges them for an access token and sends Markdown messages, which WeCom cuts at 4,096 bytes. Add the address MoleSignal connects from to the app’s trusted IPs.

Target type	Value
`direct_user`	A member’s user ID in the app’s visible range
`fixed_group`	The chat ID of a group the app created

WeCom webhook

Copy a group robot’s URL into Webhook URL. A fixed_group target uses it; a webhook target replaces it.

WeCom smart bot

A WeCom smart bot in API mode that receives messages over a long connection. Enter the bot’s Bot ID and the Long connection secret made for it, and keep the default Long connection address unless WeCom gives you another. This connector delivers no notifications, and neither notification policies nor a person’s order of methods can choose it: it only lets Mole Agent answer in WeCom. See Mole Agent in IM. For notifications, use a WeCom app or WeCom webhook connector. A member’s notification method on this connector is the user ID the smart bot sees; it only recognizes the person asking in IM.

Microsoft Teams bot

Use a Bot Framework bot. Enter its App ID, a Client secret, and its Tenant ID; for an older multi-tenant bot, the tenant is botframework.com. Keep the default service URL unless the bot runs in a regional or sovereign cloud. The bot must be installed for the people and teams it writes to.

Target type	Value
`direct_user`	A Teams user ID (`29:…`) or the person’s Microsoft Entra object ID
`fixed_group`	The conversation ID of a channel or group chat (`19:…`)

With the callback address MoleSignal gives entered as the Azure Bot’s messaging endpoint, the bot also lets Mole Agent answer in Teams. See Mole Agent in IM.

Microsoft Teams webhook

Create a channel webhook with a Workflows flow (Post to a channel when a webhook request is received), or use a classic incoming webhook, and copy its URL into Webhook URL. MoleSignal sends each message as an Adaptive Card.

Google Chat app

Use a Chat app’s service account. Paste the account’s JSON key into Service account key; it is encrypted with the connector and never returned. MoleSignal signs a token request with the key and sends messages as the app.

Target type	Value
`direct_user`	A user (`users/123…`) who has messaged the app or installed it
`fixed_group`	A space the app is in (`spaces/AAAA…`)

With a Pub/Sub subscription (projects/<project>/subscriptions/<name>), the app also lets Mole Agent answer in Google Chat. See Mole Agent in IM. Leave it empty when the app only sends notifications.

Google Chat webhook

Copy a space’s incoming webhook URL into Webhook URL. A fixed_group target uses it; a webhook target replaces it.

Phone numbers for voice and SMS

Voice and SMS connectors send to one number: the phone number a member binds (direct_user), or a fixed number in a fallback route (fixed_address). Write it with + and the country code, like +14155550100; spaces and hyphens are removed. Alibaba Cloud connectors also take an 11-digit mainland mobile number. A call reads the notification’s title, then its text, up to 400 characters; a text puts the title on one line and the text on the next, up to 320 characters. Alibaba Cloud only sends approved templates, which the title and text fill, as described below. Providers limit how often one number is called or texted. A call or text refused for that, for a wrong number, or for an unapproved template fails the delivery, and the policy goes on to the person’s next method and the fallback routes. Whether a call was answered or heard is not reported back: a successful delivery means the provider accepted the call or the text. One connector calls one number at most once a minute. Notifications that arrive within the minute wait on that line, shown as Queued to merge in the delivery log; when the minute is over they are read in one call, each notification’s title in turn, and those acknowledged meanwhile are left out. Alibaba Cloud allows one call a minute to a number anyway, so a burst of alerts is no longer refused.

Alibaba Cloud voice

Voice notifications from Alibaba Cloud Voice Service, to numbers in mainland China only. Complete the enterprise qualification in the Voice Service console, apply for a text-to-speech voice notification template such as Hello, ${content}. Please handle it now., and create an AccessKey for a RAM user that can only call Voice Service. Then fill in:

AccessKey ID and AccessKey secret;
Template code — starting with TTS_;
Caller ID — empty for the shared mode; the number you bought in the dedicated mode, which then shows on every call so on-call people can save it as a contact. The template must be of the same mode;
Title variable and Text variable — variable names in the template, such as content. The title and text are cut to the Variable length limit (35 by default) and filled in; leave both empty for a template without variables;
Times read — 1 to 3.

Alibaba Cloud calls one number at most once a minute, 5 times an hour and 20 times a day, and refuses the calls beyond that. Keep links and IP addresses out of the variables.

Alibaba Cloud SMS

Apply for an SMS signature and a notification template such as ${content}. Please handle it now. in the SMS console, then fill in the AccessKey, Signature, Template code (starting with SMS_), and the Title variable and Text variable. A variable in a notification template holds 35 characters by default; once Alibaba Cloud lifts the limit for an enterprise account, raise the Variable length limit. Variables cannot carry links or IP addresses. Numbers can be mainland mobile numbers or international numbers.

Twilio voice

Find the Account SID and Auth token on the Twilio console, then fill in:

Calling number — a voice-capable number on the account, like +14155550100;
Language — the language the notification is read in, such as en-US or cmn-CN;
Voice — optional, such as Polly.Joanna or Polly.Zhiyu; Twilio’s default voice when empty;
Times read — 1 to 3.

Twilio SMS

Fill in the Account SID, Auth token, and Sender. The sender is a number on the account (E.164), a Messaging Service (MG…), or an alphanumeric sender ID of up to 11 letters and digits where the destination country allows one. Texts to US numbers need A2P 10DLC registration first.

AWS voice and SMS

AWS voice (aws_voice) calls with SendVoiceMessage from AWS End User Messaging and Amazon Polly reads the notification; AWS SMS (aws_sms) sends a transactional text with SendTextMessage. Fill in:

Region — such as us-east-1;
Authentication — the same ways as the AWS data connectors: access key, temporary key, node identity, assumed role, or web identity. To assume a role, its trust policy requires the external ID the page shows;
Origination identity — a phone number, phone number ID, pool ID, or the ARN of one. Voice needs one, and the number must be voice-capable; SMS can leave it empty for AWS to pick a number for the destination, or name a sender ID;
Polly voice — voice only, optional: MATTHEW when empty, ZHIYU for Mandarin;
API URL — optional; the region’s endpoint when empty.

The identity needs sms-voice:SendVoiceMessage or sms-voice:SendTextMessage. An AWS account still in the sandbox only reaches verified numbers.

Generic webhook

Enter a default URL and select POST, PUT, or PATCH. Add request headers as a JSON object:

{
  "Authorization": "Bearer <token>",
  "X-Environment": "production"
}

MoleSignal sends this JSON body:

{
  "target": {
    "type": "fixed_group",
    "value": "platform-oncall",
    "metadata": {}
  },
  "message": {
    "title": "Checkout error rate is high",
    "text": "The error rate exceeded 5%.",
    "markdown": "**Checkout** error rate exceeded 5%.",
    "html": null,
    "metadata": {}
  }
}

For direct_user, fixed_address, and fixed_group, MoleSignal posts to the configured default URL and includes the target as routing data. For webhook, the target value replaces the default URL. A 2xx response is successful. If the response contains X-Request-ID, MoleSignal records the header value as the provider message ID.

Webhook URLs, authorization headers, tokens, passwords, and signing secrets are credentials. Do not put credential values in test targets, templates, or event attributes.

Bind user notification methods

Administrators can open Settings → Notify → User routing, select a member, and click Bind notify method. Each identity selects one connector and one external identity, such as an email address, a Slack or Lark user ID, or the phone number a voice or SMS connector calls. After binding an identity:

send a test to confirm provider acceptance;
verify the identity after the organization confirms ownership;
enable the identity in the Alert events, On-call events, or Reports preference;
order multiple identities from primary to fallback;
optionally configure quiet hours and allow critical alerts to bypass the restriction.

Move on when nobody acknowledges

In the order for alert events, every step after the first can wait a number of minutes:

Setting	Effect
First step	Sent as soon as the alert fires or escalates to the person.
Wait N minutes	Used to send again if nobody has acknowledged the alert N minutes after the person was first notified.
Same minutes as the step before	Used only when the step before fails to send.

For example, Lark at once, SMS after 3 minutes, a call after 5 minutes: once the alert is acknowledged or resolved, no later step is sent, including those of the people its escalations reached. A step that fails to send still moves on to the next at once. A step waits at most a day, and only for alert events; the orders for on-call events and reports only fall back on failure. Members can manage personal identities and preferences under Account settings → Notify. Reading another member’s settings requires org.members.read. Changing or attesting another member’s identity requires org.members.manage.

Remove an identity from every delivery preference before deletion.

Create templates and policies

Open Settings → Notify → Templates to create a reusable text, Markdown, or HTML body. Select a notification category, insert supported placeholders, and use the preview attributes to verify the rendered message. Then open Policies and create the routing rule:

select an event type and category;
add JSON matchers and set the policy priority;
choose a recipient resolver and resolver configuration;
respect user preferences, force one connector, or send through multiple connectors;
select a template and enable user, team, or organization fallbacks;
optionally set an acknowledgement timeout and escalation route;
inspect the live delivery preview, which resolves actual members and routes without sending.

Policies currently cover alert lifecycle and on-call schedule events. The policy editor lists the event types and recipient resolvers supported by the running backend.

Configure fallback routes

Open Settings → Notify → Fallback routes. Select an organization or team scope and a notification category. Add one or more enabled connectors, choose fixed_address or fixed_group, and enter the provider target. MoleSignal tries routes in the displayed order after the enabled personal route stages fail. The policy decides whether to use user, team, and organization fallbacks.

Inspect and retry deliveries

Open Settings → Notify → Delivery log. Filter by event ID, status, or stage. Select an attempt to inspect the masked target, connector, latency, provider error, and complete delivery chain.

alerts.read can inspect delivery history.
alerts.acknowledge can acknowledge the source event.
alerts.manage can retry failed routes.

Retries create a new attempt. Existing delivery history remains unchanged. A delivery with the stage Direct comes from a feature that names its connector and target itself, such as a scheduled log inspection. A direct delivery passes through no policy and cannot be retried.

Connector lifecycle and status

Status	Meaning
Unknown	The connector has not completed a successful or failed test yet.
Connected	The most recent test succeeded.
Error	The most recent test failed; normal routing skips the connector until a later test succeeds.
Disabled	MoleSignal does not test or deliver through the connector.

Disabling a connector does not remove references. Deletion remains blocked while a user identity, policy, fallback route, or scheduled log inspection still references the connector. Move all references before deleting the connector.

Troubleshoot delivery

Symptom	Check
SMTP authentication or TLS failure	Verify host, port, credentials, TLS mode, sender address, DNS, and outbound network access.
Slack returns an API error	Verify the bot token, `chat.postMessage` permission, target ID, and channel membership.
Lark rejects the message	Verify app permissions, recipient ID type, chat membership, webhook secret, and server clock.
Webhook returns an error	Verify the URL, method, header JSON, timeout, and a 2xx endpoint response.
No user delivery occurs	Verify the identity and connector are enabled, the category preference contains the identity, and quiet hours do not suppress delivery.
Fallback never runs	Verify the policy enables that fallback level and the category has an enabled route.
A call or text is not sent	Verify the number starts with + and the country code, the template and signature are approved, the template variable names match, and the provider’s rate limits and account sandbox.

Alerting

Create rules and follow the incident lifecycle.

Webhook connectors

Review webhook payloads, overrides, signing, and security.

​Supported connectors

​Create and test a connector

​Configure each provider

​Email SMTP

​Slack app

​Slack webhook

​Lark app

​Lark webhook

​DingTalk app

​DingTalk webhook

​WeCom app

​WeCom webhook

​WeCom smart bot

​Microsoft Teams bot

​Microsoft Teams webhook

​Google Chat app

​Google Chat webhook

​Phone numbers for voice and SMS

​Alibaba Cloud voice

​Alibaba Cloud SMS

​Twilio voice

​Twilio SMS

​AWS voice and SMS

​Generic webhook

​Bind user notification methods

​Move on when nobody acknowledges

​Create templates and policies

​Configure fallback routes

​Inspect and retry deliveries

​Connector lifecycle and status

​Troubleshoot delivery

Alerting

Webhook connectors

Supported connectors

Create and test a connector

Configure each provider

Email SMTP

Slack app

Slack webhook

Lark app

Lark webhook

DingTalk app

DingTalk webhook

WeCom app

WeCom webhook

WeCom smart bot

Microsoft Teams bot

Microsoft Teams webhook

Google Chat app

Google Chat webhook

Phone numbers for voice and SMS

Alibaba Cloud voice

Alibaba Cloud SMS

Twilio voice

Twilio SMS

AWS voice and SMS

Generic webhook

Bind user notification methods

Move on when nobody acknowledges

Create templates and policies

Configure fallback routes

Inspect and retry deliveries

Connector lifecycle and status

Troubleshoot delivery