---
title: "Recipe: Escalate SLA breaches and priority tickets"
description: "TL;DR: On a schedule (or on ticket update), this playbook finds tickets at risk of breaching SLA or marked urgent, escalates them to the on-call owner via PagerDuty, and posts an alert to Slack with the ticket and remaining time. Trigger is a schedule or webhook; outputs are a PagerDuty alert and a Slack message."
canonical_url: "https://docs.ballet.dev/articles/recipe-escalate-sla-breaches-and-priority-tickets-7RFVotelRJ"
md_url: "https://docs.ballet.dev/articles/recipe-escalate-sla-breaches-and-priority-tickets-7RFVotelRJ.md"
---
# Recipe: Escalate SLA breaches and priority tickets

**TL;DR:** On a schedule (or on ticket update), this playbook finds tickets at risk of breaching SLA or marked urgent, escalates them to the on-call owner via PagerDuty, and posts an alert to Slack with the ticket and remaining time. Trigger is a schedule or webhook; outputs are a PagerDuty alert and a Slack message.

## Who this is for

Support leads protecting response and resolution SLAs for high-priority customers.

## What you'll need

- **Connectors:** Freshdesk or Zendesk, PagerDuty, Slack.
- **Secrets:** Helpdesk API key, PagerDuty routing key, Slack token.
- **Trigger:** Schedule (e.g. every 15 minutes) or a webhook on ticket update.

## How to build it with Ask Ballet

1. Open the Console on Home.
2. Paste the prompt below; set your SLA thresholds and channels.
3. Review the plan and confirm.
4. Connect the helpdesk, PagerDuty, and Slack, then set the schedule.

```text
Build a playbook that runs every 15 minutes. Query Zendesk for open tickets where the
priority is high or the SLA due time is within the next 30 minutes. For each at-risk
ticket, trigger a PagerDuty alert to the support on-call service and post a message to
#support-escalations in Slack with the ticket link, customer, priority, and time
remaining. Avoid duplicate alerts for tickets already escalated in the last hour.
```

## What the playbook does

1. **Schedule trigger** — runs at a fixed interval.
2. **HTTP step (query)** — fetches open tickets nearing SLA breach or marked urgent.
3. **Code step (filter)** — de-duplicates already-escalated tickets and computes time remaining.
4. **HTTP step (PagerDuty)** — opens an alert for the on-call service.
5. **HTTP step (Slack)** — posts the escalation summary.

## Variations and tips

- Track escalated ticket IDs in a Code step to prevent duplicate pages.
- For incidents that span systems, hand off to the [Incident response and on-call](/articles/recipe-incident-response-and-on-call-paging-B55suUJyoW) recipe.
- Tune the schedule frequency to your tightest SLA window.

## Related articles

- [Triage and route support tickets](/articles/recipe-triage-and-route-support-tickets-M40UGJ9TVv)
- [Incident response and on-call](/articles/recipe-incident-response-and-on-call-paging-B55suUJyoW)
- [How do I manage Schedules?](/articles/how-do-i-manage-schedules-NTU9cNrk8w)
- [How do I store credentials with Secrets?](/articles/how-do-i-store-credentials-with-secrets-1D8OUcCo0n)