# Get started with Firewatch

> Configure your profile, on-call coverage, escalation policy, and first alert.

This is the machine-readable version of this Firewatch documentation page.

Firewatch needs four connected pieces before it can page anyone:

1. an active **service**;
2. an **on-call schedule** or service owners;
3. an **escalation policy** assigned to that service; and
4. at least one available notification channel for each responder.

Organization access and on-call eligibility are separate. Administrators assign
people as **Responders** when they can be scheduled or receive service-owner
escalation. **Collaborators** can view and collaborate without being eligible for
paging.

## Join or create an organization

Firewatch Cloud is designed for future self-service team signup. During the
private beta, join the access list from the Firewatch website or accept the
invitation sent by your organization. Paid checkout and automatic team
provisioning are not enabled yet.

On a new self-hosted installation, the first person to register becomes the
organization administrator. The default `Bootstrap` registration mode closes
registration after that account is created. Additional users join by
administrator invitation.

Firewatch Cloud charges only for responders. Collaborators do not consume a
responder seat. Assigning responder access at any point counts for that entire
billing month, even if the person is changed back to a collaborator later.

## 1. Check your profile

Open **Settings → Profile** and confirm:

- your name;
- your personal display time zone, or that you want to inherit the
  organization time zone; and
- your verified phone number when SMS or voice delivery is available.

Your profile time zone controls how Firewatch displays times and renders alert
templates for you. It does not change a schedule's time zone or handoff rules.

Open **Settings → Authentication** to add a passkey, set or change a password,
and configure authenticator-app two-factor authentication when local
authentication is available.

## 2. Create a service

Open **Services** and create the system you want to monitor. The creator becomes
its first primary owner. Add other primary or secondary owners as needed.

A service can have one escalation policy. Alerts for a service without an
assigned policy still create incidents, but they do not enqueue responder
notifications.

## 3. Define coverage

Open **On-call → Schedules** and create a rotation:

- choose the schedule time zone and local handoff time;
- add responders in rotation order;
- use a fixed duration or an alternating coverage pattern; and
- include only the weekdays that should have coverage.

Review the result in **Calendar**. Excluded weekdays are real coverage gaps.
Fill an intentional exception with an override; fix an accidental gap before
using the schedule for production.

## 4. Build an escalation policy

Open **On-call → Escalation policies**. The first step is immediate. Later
steps wait for their configured delay after the preceding step.

Each step can target:

- the responder currently resolved from an on-call schedule;
- every primary owner of the affected service; or
- all owners of the affected service.

Assign the policy to the service under **Services**.

## 5. Connect alert delivery

Firewatch attempts every deployment-enabled channel available for the targeted
responder:

- email when email delivery is enabled;
- Slack when the organization workspace is connected and the responder is
  mapped;
- SMS and optional voice when telephony is enabled and the responder has a
  verified phone number; and
- each enabled organization outbound webhook.

Self-hosted administrators configure provider credentials under **Admin
settings**. Firewatch Cloud operates the providers, while organization
administrators still connect their Slack workspace and responders still verify
their contact methods.

## 6. Send an alert

Open **Alert sources**, select a service, and choose an integration. Firewatch
can accept its normalized alert format directly or generate an AWS SNS/SQS
Lambda adapter.

Create an organization API key under **Settings → API keys** for external alert
senders. Store the full secret immediately—it is shown only once.

Before relying on Firewatch:

1. trigger a non-production alert;
2. confirm it creates an incident for the expected service;
3. verify the expected responder and channels;
4. acknowledge it and confirm later escalation steps are skipped; and
5. send the corresponding recovery event and confirm the incident resolves.

Before relying on Firewatch for production paging, test failure, retry, backup,
and recovery paths for your deployment.