OnCall is the on-call scheduling and incident response product built into The One Stack for MSP responder teams. It tracks who is on call at any given moment, rotates that coverage automatically, routes incoming alerts to the right person, escalates when those alerts go unacknowledged, and manages incidents through their full lifecycle. It replaces standalone tools like PagerDuty.
OnCall is used by MSP technicians who take after-hours shifts and by team leads who build the schedules and policies that govern how alerts get handled.
What OnCall Does
OnCall brings together four things that typically require separate tools:
- Scheduling — Who is on call right now, and when does that change? OnCall handles rotating calendars with daily, weekly, or custom patterns. Each schedule has a timezone and can have multiple layers (primary on-call, secondary on-call, and so on).
- Alert routing — Alerts from your RMM, monitoring tools, or security products flow into OnCall via webhook. OnCall normalizes the payload, deduplicates repeated alerts, and creates an incident.
- Escalation — If nobody acknowledges the incident within the configured delay, OnCall moves to the next step in the escalation policy, paging the next person or team. This continues until someone acknowledges or all steps are exhausted.
- Incident management — Incidents move through triggered, acknowledged, and resolved states. OnCall records a full timeline, supports notes, conference bridges, playbook executions, and post-incident reviews.
Who Uses It
- Technicians on rotation — receive pages, acknowledge and resolve incidents, log time
- Team leads — build schedules, define escalation policies, review response metrics
- Account managers or admins — review reports, adjust SLAs, export time entries to PSA
How It Integrates with RMM and PSA
OnCall connects to the rest of The One Stack in two directions:
Inbound from RMM: The RMM service pushes alerts directly into OnCall over an internal integration. OnCall enriches the incident with asset context from the CMDB if available, then fires the escalation policy. No manual webhook setup is needed for RMM alerts.
Inbound from monitoring tools: External tools (Grafana, Prometheus, Datadog, PagerDuty-compatible senders) post to a public webhook URL generated per alert source. See ./integrations.md for setup steps.
Outbound to PSA: Time logged against incidents can be marked billable, approved, and synced to the PSA product as time entries. This closes the loop from alert to billable work without re-entering data.
Key Concepts
| Term | What it means |
|---|---|
| Schedule | A rotating on-call calendar with one or more layers |
| Escalation policy | An ordered list of steps that fire when an incident goes unacknowledged |
| Service | A named monitored entity (e.g., "Prod RMM Alerts") with a default escalation policy |
| Alert source | A specific webhook endpoint for one monitoring tool, linked to an escalation policy |
| Incident | A triggered alert that has been turned into a trackable work item |
| Override | A one-time coverage change for a specific time window |
FAQ
Do I need to configure anything before alerts can come in? Yes. At minimum you need one escalation policy and one alert source (or an RMM/Defend integration enabled). The setup wizard in OnCall walks you through the required steps when you first open the product.
Can OnCall call my phone? Yes. OnCall is integrated with Voice. When an escalation step includes phone paging, Voice places an outbound call and reads the incident title and severity aloud.
Is OnCall separate from the rest of The One Stack? No. It shares authentication with the Hub, uses the same PSA integration for time sync, and receives alerts from RMM and Defend without separate configuration at the service level.
Related
- ./schedules.md — Setting up rotating on-call calendars
- ./escalation-policies.md — Defining who gets paged and when
- ./integrations.md — Connecting RMM, Defend, and monitoring tools