Aikido Trigger
CertifiedTrigger a flow on a new Aikido issue
Aikido Trigger
Trigger a flow on a new Aikido issue
Polls /open-issue-groups at the configured interval, filtered client-side to issue groups whose severity_score reaches severityThreshold, and fires one execution per newly discovered issue group (oldest first, one per poll cycle) so no issue is skipped even during a burst. Since Aikido sorts this endpoint by priority rather than detection time, every poll walks every open issue group page to find new ones. The trigger tracks the first_detected_at of the newest delivered issue group in namespace KV to avoid re-firing; on the first poll, only the current baseline is recorded — no execution is fired — to avoid flooding on initial activation. An issue group whose severity is later re-scored upward, or that is re-opened after being snoozed, is not re-delivered if its first_detected_at is older than the recorded baseline.
type: io.kestra.plugin.aikido.issues.TriggerExamples
React to new critical issues via polling trigger
id: aikido_critical_issue_alert
namespace: company.security
triggers:
- id: on_new_critical_issue
type: io.kestra.plugin.aikido.issues.Trigger
clientId: "{{ secret('AIKIDO_CLIENT_ID') }}"
clientSecret: "{{ secret('AIKIDO_CLIENT_SECRET') }}"
severityThreshold: 80
interval: PT5M
tasks:
- id: notify
type: io.kestra.plugin.core.log.Log
message: "Critical issue detected: {{ trigger.issueType }} — severity {{ trigger.severityScore }}"
Properties
clientId *string
OAuth2 client ID
Client ID of an Aikido API client with the OAuth2 scopes required by the tasks and triggers being used (for example issues: read, repositories: write). Client credentials are created in the Aikido console under Settings > API access.
clientSecret *string
OAuth2 client secret
Client secret of the Aikido API client. Exchanged for a short-lived JWT Bearer token on first use (and transparently refreshed before it expires); never logged or included in error messages.
allowConcurrent boolean
falseSpecifies whether a trigger is allowed to start a new execution even if a previous run is still in progress.
baseUrl string
https://app.aikido.devAikido API base URL
Base URL of the Aikido Security application for your account's region: https://app.aikido.dev (Europe, default), https://app.us.aikido.dev (United States), https://app.au.aikido.dev (Australia), or https://app.me.aikido.dev (Middle East). The OAuth2 token endpoint is derived from this same host, so a region override applies to both authentication and API calls.
interval string
PT5MdurationPolling interval
How often to poll the Aikido API for new issues. Defaults to PT5M (every 5 minutes).
severityThreshold integerstring
0Severity threshold
Minimum severity_score (0-100, Aikido's own numeric severity scale — not the Severity enum used elsewhere in this plugin) an issue group must reach to fire an execution. Defaults to 0 (any severity fires).
stopAfter array
CREATEDSUBMITTEDRUNNINGPAUSEDRESTARTEDKILLINGSUCCESSWARNINGFAILEDKILLEDCANCELLEDQUEUEDRETRYINGRETRIEDSKIPPEDBREAKPOINTRESUBMITTEDList of execution states after which a trigger should be stopped (a.k.a. disabled).
when string
trueA condition that determines whether the trigger should run.
A Pebble expression evaluated at trigger time. The trigger fires only when the expression evaluates to a truthy value (true, a non-empty string, a non-zero number). Use this to gate trigger execution on dynamic runtime values such as execution labels, flow variables, or environment conditions.
Outputs
firstDetectedAt integer
Unix timestamp (seconds) this issue group was first detected
issueGroupId integer
Issue group ID
issueType string
Issue type
For example open_source, leaked_secret, sast, or iac.
severity string
Human-friendly severity
One of critical, high, medium, or low.
severityScore integer
Numeric severity, from 1 (lowest) to 100 (highest)
title string
Issue title
