> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SolarWinds Orion

> Read monitoring data and manage alerts in your SolarWinds Orion instance from Serval workflows.

Connect your SolarWinds Orion instance so Serval workflows can query monitoring data, read devices, and manage alerts. This **beta** integration calls the [SolarWinds Information Service (SWIS) REST API](https://solarwinds.github.io/OrionSDK/docs/rest/) on demand.

<Note>
  Orion versions and installed modules vary. Before production use, validate the
  reads and alert actions against your instance and service-account permissions.
  Serval's synthetic contract checks do not establish compatibility with your
  Orion server.
</Note>

## Prepare Orion

1. Create a dedicated Orion account. Give it access to the nodes and alerts your workflows need, plus permission for the alert actions you intend to expose.
2. Confirm the SWIS HTTPS address and port. Orion 2023.1 moved SWIS REST to **17774**; older installations may use **17778**. Use your installation's actual port. See the [SWIS endpoint reference](https://solarwinds.github.io/OrionSDK/docs/rest/).
3. Make that address reachable from Serval or your self-hosted worker, and configure trust for its TLS certificate.

The connection uses a username and password with HTTP Basic authentication. Serval stores the password encrypted and injects it into requests; workflow code never receives it. Access remains limited by the Orion account's permissions.

<Info>
  For private Orion servers, enable **Run on self-hosted workers** in the
  connection's settings. Upgrade the worker and credential proxy to a version
  that includes the SolarWinds Orion connector before using private routing. The
  worker and proxy must resolve the hostname, reach its SWIS port, and trust its
  certificate. See [Private network
  access](/sections/self-hosting/private-network-access). Keeping credentials in
  your own cluster requires the separate [worker-local credential
  setup](/sections/self-hosting/deployment/worker-local-integrations).
</Info>

## Connect in Serval

1. Open **Integrations**, find **SolarWinds Orion**, and choose **Connect**.
2. Enter **Orion server URL**, including `https://` and the SWIS port; for example, `https://orion.example.com:17774`. Do not include `/SolarWinds/InformationService/v3/Json` or another path.
3. Enter the account's **Username** and **Password**, then save.
4. Run the connection healthchecks to confirm read access. They do not establish permission to perform alert actions.

When editing the connection, an unchanged masked or empty password retains the saved password. Changing the server URL or username requires a fresh password.

The read healthchecks separately test node access, active-alert access, and alert-history access. A passing check with zero rows means the query succeeded; it does not establish that the account can see your entire monitored estate.

## Available actions

| Action | Use |
| - | - |
| List nodes / get node details | Read monitored devices, status, IP address, vendor, and details links. |
| List active alerts / get alert history | Inspect current alerts and past alert events. |
| Query / read entity | Run a parameterized SWQL SELECT, including custom properties, or read an entity by its SWIS URI. |
| Acknowledge / unacknowledge | Change an alert's acknowledgement state. |
| Append alert note | Add a note without changing acknowledgement. |
| Mute / resume entity alerts | Set a maintenance window or end suppression. |
| Get entity alert suppression state | Inspect scheduled, direct, and inherited suppression. |

Installable workflows provide node details, active alerts, acknowledgement, notes, and maintenance actions. Read workflows can run without approval; write workflows request approval by default when installed. Review that policy for your team.

## Queries and pagination

The `query` helper takes an ordered SWQL SELECT and adds row pagination. Omit `TOP`, existing row ranges, and comments from its query text. Its default page size is 100, its maximum is 1,000, and it returns `nextStartRow` for the next page. Supply values through `parameters`, rather than interpolating them into query text. The lower-level `apiRequest` requires an explicit `TOP` or ordered `WITH ROWS` bound.

Each page is a separate request; monitoring data can change between pages. Empty results describe only data visible to the configured account.

## Alert actions

Use **AlertObjectID** for acknowledgement and notes, and a **SWIS entity URI** for muting. Muting applies to the entity's children and keeps polling active. Serval requires a future RFC 3339 end time with `Z` or a colon-separated timezone offset, such as `2026-10-13T20:00:00+01:00`. Resuming an entity does not remove suppression inherited from a parent. See [SolarWinds alert operations](https://solarwinds.github.io/OrionSDK/docs/alerts/).

Requests are not automatically retried. If a write times out, inspect Orion before repeating it, especially when appending notes.

## Troubleshooting

| Symptom | Check |
| - | - |
| Connection timeout | Hostname, SWIS port, firewall rules, and worker routing. |
| Certificate error | Certificate hostname and the proxy's trusted certificate chain. |
| Authentication failure | Account credentials and account access to SWIS. |
| Missing nodes or alerts | The connected account's visibility and the query filters. |
| Read checks pass but writes fail | The account's permission for that specific alert operation. |

This connection sends requests into Orion. Alert delivery from Orion to Serval and scheduled CMDB ingestion use separate workflows.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.