# The service

Source: https://www.pingtower.com/docs/service/

The inbound half. It ingests structured log lines, recovers each message's shape, evaluates declarative rules, and keeps alert state with re-notify escalation until a human acknowledges.

The service is one Go binary with SQLite inside it. It runs hosted at api.pingtower.com and, unchanged, on [your own box](/docs/self-hosting/). Every page in this section applies to both.

<div class="docs-flow"><span class="st">ingest</span><span class="ar">→</span><span class="st">template &#43; dedup</span><span class="ar">→</span><span class="st">rules</span><span class="ar">→</span><span class="st open">alert</span><span class="ar">→</span><span class="st">renotify · escalate</span><span class="ar">→</span><span class="st">deliver</span></div>


A line arrives with a level and a message. Its shape is recovered so repeats collapse into one alert with a count. Every rule in the project is evaluated against it. A rule that fires opens an alert, and the alert re-pages on the rule's cadence and climbs its escalation ladder until someone acks. Delivery goes to the iOS app by push and to anything else through integrations.


## In this section

- [Ingest](https://www.pingtower.com/docs/service/ingest/index.md): One endpoint, one JSON object per line, one bearer token per source. Everything Pingtower knows starts here.
- [Rules](https://www.pingtower.com/docs/service/rules/index.md): A rule says what to look for, how much of it is a problem, and what to do about it. Rules are per project, declarative, and editable from the phone.
- [Alerts & escalation](https://www.pingtower.com/docs/service/alerts/index.md): An alert has three states and two verbs. Everything about paging follows from that.
- [Log tail & templates](https://www.pingtower.com/docs/service/logtail/index.md): The actual lines behind an alert, filtered to the shape that matched. Kept only for sources that ask for it.
- [Projects & sources](https://www.pingtower.com/docs/service/projects/index.md): A project is a namespace inside a tenant. A source is one thing that sends into it, with its own token.
- [Integrations](https://www.pingtower.com/docs/service/integrations/index.md): Tell something other than your phone. Every integration keeps a per-event delivery log, so when Slack goes quiet you can see whether it was you or them.
- [Actions](https://www.pingtower.com/docs/service/actions/index.md): A runbook action is an HTTP call the service makes for you when an alert opens. Restart the worker, open the ticket, flip the feature flag, before anyone wakes up.
- [On-call schedules](https://www.pingtower.com/docs/service/oncall/index.md): A schedule answers "who is on call right now". Rules name schedules in their escalation ladders, so the rule never changes when the rota does.
- [Reports](https://www.pingtower.com/docs/service/reports/index.md): A running incident report with a shareable status page. Write it in Markdown from the phone while the incident is still going.
- [Team & account](https://www.pingtower.com/docs/service/team/index.md): Invite teammates, manage members, mint and revoke API keys, and read the audit log of who did what.
- [Plans & quotas](https://www.pingtower.com/docs/service/plans/index.md): Limits are per tenant. Usage against them is on the Account → Plan & usage screen in the app and at GET /v1/tenants/{tid}/plan.