Deep Dive
Notifications
Configure and operate tenant alert delivery
SQIP delivers tenant quota and usage alerts through email, Slack, or Microsoft Teams. A channel works only when it is available at platform level, enabled for the tenant, and has a saved destination.
Permissions
| Task | Permission or role |
|---|---|
| View tenant channel state | notifications:read |
| Save, enable, disable, or clear a destination | notifications:update |
| Read destination-free delivery history through the API | notification-deliveries:read |
| Enable delivery methods for all tenants | Platform administrator |
| Inspect and requeue dead letters | Platform administrator |
Configure a tenant destination
- Open Notification.
- Choose the tenant.
- Find the required channel and enter its destination.
- Select Save destination.
- Enable delivery for the channel.
| Channel | Accepted destination |
|---|---|
| Email via Resend | Up to 10 valid email addresses separated by commas |
| Slack | An HTTPS incoming webhook on hooks.slack.com or hooks.slack-gov.com |
| Microsoft Teams | An HTTPS webhook on a supported Microsoft webhook.office.com, webhook.office365.com, or logic.azure.com host |
Destinations are encrypted before storage and are never returned to the console. After a destination is saved:
- Leave the field blank and select Save destination to keep it.
- Enter a new value and save to replace it.
- Select Clear destination to disable the channel and remove it.
Note
The status is Delivery enabled only when the platform channel and tenant setting are both enabled and a destination is saved.
Platform channel availability
Platform administrators open Platform Admin → Notifications to make a delivery method available to tenants. Email cannot be enabled until the Resend API key and sender are configured. All channels require the platform notification encryption key.
Disabling a platform channel immediately stops pending and future tenant deliveries through it, but preserves tenant destinations in encrypted form. Re-enabling it allows eligible tenant settings to resume without re-entering those destinations.
Delivery behavior
Alert state and delivery work are committed together to a durable outbox. Each alert/channel combination has an idempotency key. Workers deliver asynchronously, retry temporary failures with bounded backoff, and move exhausted or non-recoverable deliveries to a dead-letter queue.
A queued delivery is skipped if, before it is sent:
- The platform administrator disables the channel.
- The tenant disables the channel.
- The tenant clears or replaces the destination.
Audit and delivery records contain channel, event, severity, attempt, status, provider response, and safe error details. They do not contain recipient addresses or webhook URLs.
Troubleshoot delivery
- Confirm the channel says Delivery enabled for the correct tenant.
- Confirm the platform administrator has made the channel available.
- For email, confirm platform Resend credentials and the sender are configured.
- Replace and save a webhook if it was rotated.
- Review destination-free delivery history and Audit Logs for retry, skipped, or dead-letter events.
- Ask a platform administrator to correct the provider issue and requeue a dead letter.
Test every production destination after configuration and after credential or webhook rotation.