Skip to main content
Connect your SolarWinds Orion instance so Serval workflows can query monitoring data, read devices, and manage alerts. This beta integration calls the SolarWinds Information Service (SWIS) REST API on demand.
Orion versions and installed modules vary. Before production use, validate the reads and alert actions against your instance and service-account permissions. Serval’s synthetic contract checks do not establish compatibility with your Orion server.

​
Prepare Orion

  1. Create a dedicated Orion account. Give it access to the nodes and alerts your workflows need, plus permission for the alert actions you intend to expose.
  2. Confirm the SWIS HTTPS address and port. Orion 2023.1 moved SWIS REST to 17774; older installations may use 17778. Use your installation’s actual port. See the SWIS endpoint reference.
  3. Make that address reachable from Serval or your self-hosted worker, and configure trust for its TLS certificate.
The connection uses a username and password with HTTP Basic authentication. Serval stores the password encrypted and injects it into requests; workflow code never receives it. Access remains limited by the Orion account’s permissions.
For private Orion servers, enable Run on self-hosted workers in the connection’s settings. Upgrade the worker and credential proxy to a version that includes the SolarWinds Orion connector before using private routing. The worker and proxy must resolve the hostname, reach its SWIS port, and trust its certificate. See Private network access. Keeping credentials in your own cluster requires the separate worker-local credential setup.

​
Connect in Serval

  1. Open Integrations, find SolarWinds Orion, and choose Connect.
  2. Enter Orion server URL, including https:// and the SWIS port; for example, https://orion.example.com:17774. Do not include /SolarWinds/InformationService/v3/Json or another path.
  3. Enter the account’s Username and Password, then save.
  4. Run the connection healthchecks to confirm read access. They do not establish permission to perform alert actions.
When editing the connection, an unchanged masked or empty password retains the saved password. Changing the server URL or username requires a fresh password. The read healthchecks separately test node access, active-alert access, and alert-history access. A passing check with zero rows means the query succeeded; it does not establish that the account can see your entire monitored estate.

​
Available actions

Installable workflows provide node details, active alerts, acknowledgement, notes, and maintenance actions. Read workflows can run without approval; write workflows request approval by default when installed. Review that policy for your team.

​
Queries and pagination

The query helper takes an ordered SWQL SELECT and adds row pagination. Omit TOP, existing row ranges, and comments from its query text. Its default page size is 100, its maximum is 1,000, and it returns nextStartRow for the next page. Supply values through parameters, rather than interpolating them into query text. The lower-level apiRequest requires an explicit TOP or ordered WITH ROWS bound. Each page is a separate request; monitoring data can change between pages. Empty results describe only data visible to the configured account.

​
Alert actions

Use AlertObjectID for acknowledgement and notes, and a SWIS entity URI for muting. Muting applies to the entity’s children and keeps polling active. Serval requires a future RFC 3339 end time with Z or a colon-separated timezone offset, such as 2026-10-13T20:00:00+01:00. Resuming an entity does not remove suppression inherited from a parent. See SolarWinds alert operations. Requests are not automatically retried. If a write times out, inspect Orion before repeating it, especially when appending notes.

​
Troubleshooting

This connection sends requests into Orion. Alert delivery from Orion to Serval and scheduled CMDB ingestion use separate workflows.