Opsgenie connection¶
Send alerts to Opsgenie from a task over a managed Leoflow Connection. The
host and API key are encrypted at rest and delivered to the task as
AIRFLOW_CONN_<CONN_ID>.
URI shape¶
Opsgenie authenticates with an API key, not a login: the key lives in the
Password field, so the URI has an empty username. The control plane
percent-escapes the key; OpsgenieAlertHook un-escapes it back. There is no
port.
Fields the UI asks for¶
| Field | Required | Notes |
|---|---|---|
| Conn Id | yes | e.g. opsgenie_default. Exported as AIRFLOW_CONN_OPSGENIE_DEFAULT. |
| Conn Type | yes | opsgenie. |
| Host | yes | The API host, e.g. api.opsgenie.com (or api.eu.opsgenie.com). |
| Login | no | Leave blank — Opsgenie uses an API key, not a username. |
| Password | yes | The Opsgenie API key. Stored encrypted at rest (ADR 0019). |
| Extra | optional | JSON for hook-specific options. |
Example DAG¶
The hook is imported inside the task body so DAG parsing stays import-light.
from airflow.decorators import dag, task
from pendulum import datetime
@dag(schedule=None, start_date=datetime(2026, 1, 1), catchup=False)
def opsgenie_alert():
@task
def page():
from airflow.providers.opsgenie.hooks.opsgenie import OpsgenieAlertHook
hook = OpsgenieAlertHook(opsgenie_conn_id="opsgenie_default")
hook.create_alert(payload={"message": "Leoflow pipeline failed"})
page()
opsgenie_alert()
Security notes¶
- API key is the credential: store it in Password, never in Extra in plaintext form you log. The key grants alert-create rights.
- Secrets in logs: never
print()the URI — it carries the API key. - gRPC channel (agent ↔ control plane): secrets are served only over an authenticated channel (ADR 0021); Pro must run with TLS.