Rootly

Trustle reads users, roles, on-call roles, teams, schedules and shifts, escalation policies, services, and the audit log from Rootly. Trustle can add and remove people on schedules, teams, and escalation policies, create and end override shifts, change on-call roles, and create API keys for AI agents.

Prerequisites

• A Rootly user who can manage roles and API keys, for example an Owner or Admin.
• People in Rootly before Trustle grants them access. Trustle cannot create Rootly users. Trustle matches people by email.
• An identity provider connected in Trustle, for example Okta or Microsoft Entra ID. Trustle hides SaaS Applications until one is connected.

Configure Rootly

Step 1: Grant permissions

Rootly gives an API key its permissions through roles. Create two custom roles for Trustle. A key with the Owner or Admin role also works, but it gives Trustle more than it needs.

1. In Rootly, go to Configuration → Roles & Permissions.

2. Create a custom incident response role and a custom on-call role.

3. Give the roles these permissions:

   Permission	Required	What Trustle does with it
   Read on users, teams (groups), schedules, shifts, escalation policies, and services	Yes	Imports people, teams, schedules, on-call shifts, escalation policies, and services.
   Create, update, and delete on schedules and schedule overrides	Yes	Adds and removes people on schedule rotations. Creates and ends override shifts.
   Create, update, and delete on escalation policies	Yes	Adds and removes people as targets of an escalation level.
   Update on groups (teams)	Yes	Adds and removes team members.
   Update on on-call roles and users	Yes	Changes a user’s on-call role.
   Read on roles and on-call roles	Optional	Imports roles and on-call roles. Without it, Trustle shows no roles, and AI agents cannot request API keys.
   Read on audits	Optional	Shows the last date each user changed something in Rootly. Without it, the date stays empty.
   Create, read, and delete on API keys	Optional	Creates an API key for an AI agent when an access request is approved, and deletes the key when the access ends. Without it, these requests fail.

4. Save both roles.

Note

Rootly returns 404, not 403, when a role cannot read a list. Trustle then skips roles, on-call roles, or audits, and the sync still finishes. The data stays missing until you add the read permission.

Step 2: Create a Global API key

1. Go to Organization Settings → API Keys.
2. Create a new API key. Enter a description, for example Trustle.
3. Select the Global scope. A Team key cannot see other teams. A Personal key stops working when its user leaves.
4. Assign the two custom roles from Step 1.
5. Note the expiration date of the key. Rootly keys expire.

Step 3: Collect the values for Trustle

1. Copy the key.

Caution

Rootly shows the key once. If you lose it, create a new key.

Trustle field	Where to find it in Rootly	Example
API Token	The Global API key from Step 2	rootly_0123456789abcdef…

Connect in Trustle

1. In Trustle, go to Connections.
2. Under SaaS Applications, find Rootly and click Connect.
3. Enter a Connection Name, for example Rootly production. Description is optional.
4. Enter the value from Step 3.
5. Click Test Connection.
6. After the test passes, click Save Connection.

Note

Test Connection checks only that Rootly accepts the key. It does not check any permission. Do the steps in Verify after the first sync.

Verify

1. On the Connections page, open the Rootly connection.
2. Wait for the first sync to finish.
3. Check that the user count, the team count, and the schedule count match Rootly.
4. Check that Trustle shows the roles and the on-call roles. If they are missing, the key cannot read them.

If something is missing, see Troubleshooting.

Caution

When an on-call role grant ends, Trustle sets the user’s on-call role to None (no_access). The user does not get their earlier on-call role back.

Security notes

Note

• Use a dedicated Global key with custom roles for Trustle only. Do not use a Personal key.
• Store the key in a secret manager. Never commit it to a repository.
• Create a new key before the old key expires. Then paste the new key into the Trustle connection.
• Rootly logs the changes that the key makes under a bot user, not under a person.

Troubleshooting

Test Connection fails

Check these values:

• API Token: copy the whole key. Check that it did not expire and that nobody revoked it (401).
• Rate limit: Rootly allows few calls per minute on some plans, for example 50 on a trial (429). Wait one minute and test again.

Test Connection passes, but roles, on-call roles, or last-activity dates are missing

The key’s roles cannot read them. Rootly answers 404 for a missing read permission. Add read on roles, on-call roles, or audits in Step 1. Trustle shows the data after the next sync.

Trustle cannot grant access to a person

Trustle cannot create Rootly users. Invite the person to Rootly with the same email as in Trustle. Then wait for the next sync.

AI agents cannot get a Rootly API key

Add create, read, and delete on API keys to the incident response role in Step 1.

The sync stops working

The key expired. Create a new key in Step 2. Then paste it into the Trustle connection.

None of these fixes work

Email support@trustle.com. Include the error message, the connection name, and the Rootly organization name. Never send a secret, key, or token.