# Concepts

Spectate turns a failed check into an alert, and an escalation path decides who gets the alert. People work on bigger problems in an incident and tell customers on a status page. This page explains each part and how one leads to the next.

## From a failed check to a status page

1. A **monitor** watches one target, for example `https://example.com/health`, from one region.
2. A **check** is one run of a monitor. Spectate runs a check at each interval, for example every 60 seconds.
3. If a check fails, Spectate checks again about 5 seconds later from the same region. If that check also fails, the monitor is down.
4. Spectate fires an **alert**: "Website is down", with the severity `critical`.
5. The alert follows one or more **escalation paths**. A path is a list of steps: notify a [channel](/alerting/channels), page the person [on call](/alerting/on-call), wait, or create an incident.
6. A **channel** delivers the notification: email, Slack, Discord, Microsoft Teams, Telegram, webhook, Pushover, SMS or a voice call.
7. A person acknowledges the alert. Escalation stops, and the next steps do not run.
8. If the problem needs more work, the team declares an **incident**, or an escalation step creates one.
9. The team publishes the incident on a **status page**, and subscribers get an email.
10. When a check succeeds again, Spectate resolves the alert and sends a resolved notification.

Monitors are one source of alerts. [Hosts](/hosts/introduction), [domains](/domains/introduction), status pages and [alert sources](/alerting/alert-sources) such as Grafana or Sentry also fire alerts. All alerts follow escalation paths in the same way.

## Alerts and incidents

An alert and an incident are different things in Spectate. An alert is a signal from a machine. An incident is the work of people.

| | Alert | Incident |
|---|---|---|
| Starts when | A monitor, host, domain, status page or alert source finds a problem | A member declares it, or an escalation step creates it |
| States | `firing`, `resolved`. A firing alert can also be acknowledged. | `investigating`, `identified`, `monitoring`, `resolved` |
| Ends when | The source recovers, or a member resolves it by hand | A member resolves it |
| Has | A severity, an escalation log, the check result that caused it | Updates, roles, a timeline and a postmortem |

Not every alert needs an incident. A certificate that expires in 14 days is an alert. A checkout page that is down for all customers is an incident.

Spectate deduplicates alerts. While an alert for a problem is firing, the same problem does not fire a second alert. Each alert runs from a copy of its escalation path, made when the alert fires. If you change a path, only new alerts use the change.

Severities, from high to low: `critical`, `high`, `medium`, `low`. See [Alerts](/alerting/alerts) and [Incidents](/incidents/introduction).

## Which escalation paths an alert follows

Spectate looks for escalation paths in this order and uses the first level that has paths:

1. The paths set on the monitor, host, domain or status page itself.
2. The paths of its [project](/account/projects).
3. The team default path.

If none of these exist, the alert notifies nobody. The alert still shows on the **Alerts** page. Spectate skips a disabled path. In the dashboard, the **Alerting** section of a monitor shows which paths its alerts follow.

## Teams, members and roles

All data belongs to a **team**: monitors, hosts, alerts, incidents, status pages and the plan. A person can be a **member** of more than one team, with one role in each team.

| Role | Can do |
|---|---|
| Owner | Everything, including billing and deleting the team. Each team has one owner. |
| Manager | Everything except billing and deleting the team. |
| Admin | Configure monitoring, alerting, incidents and status pages. Cannot manage members, team settings or API tokens. |
| Member | Read everything. Create and change monitors and incidents. Acknowledge and resolve alerts. |
| Billing | Billing and support only. |

See [Teams and roles](/account/teams-and-roles) and [Members](/account/members).

## Projects

A **project** groups monitors, hosts and domains, for example `Production` and `Staging`. A project can have its own escalation paths. Resources in the project follow those paths, unless a resource sets its own paths.

Every team has a default project. New monitors and hosts join it when you do not select another project. You cannot delete the default project. See [Projects](/account/projects).

## Regions

Spectate runs checks from four regions:

| Region | Value in the API |
|---|---|
| Europe | `eu` |
| North America | `us` |
| Asia | `as` |
| Oceania | `oc` |

Each monitor has one primary region. All its checks, rechecks, response times and uptime come from that region. See [Locations and checks](/monitors/locations-and-checks).