Send AWS CloudTrail alerts to on-call with CallHeim.

# CloudTrail API calls reach CallHeim through an EventBridge rule you create in your own AWS account — nothing forwards them for you.
# EventBridge → API destinations → Connections → Create connection. Authorization type: API Key, with API key name X-Placeholder and any value. EventBridge requires one; CallHeim does not read it. Do not use Authorization or an X-CallHeim- / X-ItOnCall- header name, which CallHeim does read.
# EventBridge → API destinations → Create API destination: endpoint {{WEBHOOK_URL}}, HTTP method POST, using the connection you created above.
# EventBridge → Rules → Create rule on the default event bus, with this event pattern:
{"detail-type":["AWS API Call via CloudTrail"],"detail":{"eventName":["StopLogging","DeleteTrail","DeleteBucket"]}}
# Target: EventBridge API destination → the API destination you created above. Keep the target input as "Matched events" — no input transformer — so CallHeim receives the event exactly as EventBridge emits it. Let the console create the rule's execution role (it needs events:InvokeApiDestination on the destination).
# Replace the eventName list with the API calls that should page. Without it, every write call in the account opens an incident.
# EventBridge receives these events only from a CloudTrail trail with logging on in that region.
# A call that failed (it carries an error code) opens a P2, any other a P3. Each call is its own incident and has no recovery event, so these incidents do not auto-resolve.
# EventBridge rules, connections and API destinations are regional: repeat the connection, API destination and rule in every region you want covered.