Skip to main content
Orbitrage notifies you when a metric crosses a threshold you set, or when its detectors spot an anomaly on their own. Both deliver to a webhook URL or to Slack.

​
Threshold alerts

Create an alert from the Customise page or by asking Ask Analytics (create_alert). An alert watches one metric over a sliding window and fires when it crosses your threshold.
​
string
required
One of calls_count, cost_total, savings_total, tokens_in, tokens_out, tokens_total, errors_count, tool_calls_count, unique_users, unique_models, avg_latency_ms, p95_latency_ms.
​
string
required
Comparison: >, <, >=, or <=.
​
number
required
The value to compare against.
​
number
default:"5"
Sliding window to evaluate the metric over (1–1440).
​
number
default:"60"
Minimum gap between fires (1–10080).
​
string
required
An https:// receiver. A hooks.slack.com URL is auto-formatted for Slack.
​
object
Optional scoping by workflow_id, end_user_id, model, provider, or tool_name.

​
Webhook payload

When a non-Slack alert fires, Orbitrage POSTs JSON and signs it:
The request carries X-Orbitrage-Signature: <hex>, an HMAC-SHA256 of the raw body using the alert’s webhook secret (shown once at creation). Verify it:
Slack webhooks (hooks.slack.com) receive Block Kit instead of the signed JSON — the URL itself is the secret, so no signature is added.

​
Anomaly detection (automatic)

Beyond explicit thresholds, Orbitrage learns each org’s normal pattern and alerts on deviations — no configuration beyond a Slack connection.
  • Baselines are computed per hour-of-week (so 3pm Tuesday is judged against past 3pm Tuesdays), as a rolling mean and standard deviation over calls, cost, errors, and tokens.
  • Each hour, the just-completed hour is compared to its baseline. If it deviates beyond a Z-threshold (default 3) — and the same metric hasn’t already fired this hour — a Block Kit message is posted to your Slack channel.
  • Anomalies are skipped when there aren’t enough samples yet (minimum 3 for that hour-of-week) or while a cooldown is active.
Same statistical engine as the Intelligence layer.

​
Delivering to Slack

​
Scheduling (self-hosted note)

Alerts and anomaly checks run on a schedule (every minute for threshold alerts; hourly for anomalies) authenticated with a shared CRON_SECRET. The managed platform wires this up already; if you self-host, schedule the cron endpoints via pg_cron + pg_net or any external scheduler.