# Axiom > Connect Axiom so monitor alerts open incidents in Ace, and Ace investigates them by querying your logs and events with APL. Source: https://tryace.dev/docs/integrations/axiom Ace queries logs and events in the Axiom datasets you choose, with bounded APL over the incident window, and monitor alerts open incidents. | | | | --- | --- | | Category | Logs | | Ace reads | Event volume, text search and APL results in your datasets, and monitors and their notifications | | Ace can change | Annotations on your datasets when an incident opens and resolves | | Opens incidents | Yes, from monitor alerts | | Setup | Settings form | ## What Ace reads Ace reads only the datasets you list and never reads or lists other datasets, including for the System Map. Each query runs on one dataset over the incident window and returns a limited number of rows, and Ace refuses a query that reaches another dataset, for example through a union, join or lookup. - Event counts over time in one dataset, optionally split by a field. - Case-insensitive text search, newest first. - One APL pipeline over one dataset. - Monitors on your datasets, with their query, threshold and the notifications they sent in the window. ## What Ace can change | Action | What it does | Approval | Undo | | --- | --- | --- | --- | | Annotation | When an incident opens or resolves, Ace adds one annotation to the connection's datasets so your charts show it, for example "Incident opened: ``" | Runs on its own | Yes. Undo from the incident deletes the annotation | Ace adds annotations only after an admin turns on **Allow Ace to update this tool during incidents** for the connection. See [Actions and approvals](https://tryace.dev/docs/concepts/actions-and-approvals). Ace can't check annotation permissions in advance, so Settings shows **Shows when it runs: needs Annotations: create, delete**, and a missing permission shows up only when Axiom refuses the update. ## What opens an incident Monitor alerts reach Ace through a custom webhook notifier as they fire. Ace doesn't poll Axiom, so nothing arrives until the notifier is set up. - A notification with action **Open** opens a high-severity incident or joins the one already open on the workload, and **Closed** resolves it. Ace ignores other notifications. - When Ace adds its notifier, it skips monitors with `ace:ignore` in their name or description. An alert opens an incident only when Axiom is routed to a workload. To route it, open the workload's settings, turn on **Integration alerts** under **Investigation triggers** and select Axiom under **Alert sources**. ## Before you start - The **admin** role in Ace. See [Roles and permissions](https://tryace.dev/docs/security/roles-and-permissions). - Permission in Axiom to create API tokens. You can't change a token's permissions later, so if you want alert wiring or annotations, add those permissions when you create the token. ## Credentials and permissions Ace uses one API token, with the permissions below. | Credential | Where to create it | Permissions | Why Ace needs it | | --- | --- | --- | --- | | API token (required) | **Settings** > **API tokens** | Query on each dataset you list, and **Datasets**: read | Queries your datasets and lists them | | Same token (only for alerts) | | **Monitors**: read, update, and **Notifiers**: create, read, update, delete | Adds Ace's notifier to your monitors | | Same token (only for actions) | | **Annotations**: create, delete | Adds and deletes incident annotations | ## Set up ### Create the API token 1. In Axiom, open **Settings** > **API tokens** > **New API token**, name it Ace and set an expiration date. 2. Under **Token permissions**, choose **Advanced**, then **Custom**, and add Query on each dataset Ace should read. Under **Org level permissions**, add **Datasets**: Read. 3. If Ace should wire monitor alerts, add **Monitors** (read, update) and **Notifiers** (create, read, update, delete). For incident annotations, add **Annotations** (create, delete). 4. Optionally set query cost limits, then create the token and copy it. ### Connect Axiom in Ace 1. In Ace, go to **Settings** > **Data sources** > **Axiom**. 2. Fill in the form: - **API token**: the token you copied. - **Organization ID** (optional): required for personal tokens. Find it under **Settings** > **General** > **ID**, or after `app.axiom.co/` in the app URL. - **Datasets**: the datasets Ace may read, comma-separated. List at least one. - **API URL** (optional): only if you don't use `https://api.axiom.co`. It must use HTTPS and be reachable from the public internet, because Ace doesn't connect to private or internal network addresses. 3. Choose **Connect Axiom**. Ace saves the token only if it can see each dataset. ### Wire alerts If the token can manage monitors and notifiers, Ace creates a custom webhook notifier named `ace-` and adds it to every monitor except those marked `ace:ignore`. Ace checks again every hour to pick up new monitors, and removes the notifier when you disconnect. > **Adding a notifier resets a monitor's alert state** > > Axiom replaces a monitor when its notifiers change, so every monitor that gets Ace's notifier starts its alert state over. To set it up yourself, choose **Show manual setup** in the **Alerts** section: 1. Copy the webhook URL Ace shows. 2. Choose **Generate token** and copy the token. Ace shows it once. 3. In Axiom, open **Monitors** > **Manage notifiers** > **New notifier**, choose **Custom webhook**, enter the URL as the **Webhook URL**, add an `Authorization` header of `Bearer ` and choose **Create**. 4. Add the notifier to the monitors that should open incidents. ### Allow annotations (optional) On the connected Axiom page, turn on **Allow Ace to update this tool during incidents**. ## Confirm it's working - The connection shows **Connected** and the number of datasets the token sees. - The **Alerts** section shows **Waiting for first event** until the first delivery Ace accepts, then **Verified**. ## Disconnect 1. In Ace, go to **Settings** > **Data sources** > **Axiom** and choose **Disconnect**. Ace removes its notifier from your monitors and deletes it, and if it can't, it tells you so you can remove `ace-` in Axiom yourself. 2. In Axiom, delete the API token. ## Next steps - [Actions and approvals](https://tryace.dev/docs/concepts/actions-and-approvals): how observability updates and undo work. - [How Ace works](https://tryace.dev/docs/concepts/how-ace-works): how alerts become incidents. - [Integrations](https://tryace.dev/docs/integrations): connect more data sources.