recovery.installation_failed_over

Automatic failover switched a project onto its standby bot without the creator, because the platform refused the live one — the bot-side twin of resource_failed_over.

When this fires

A probe finds the platform refusing a project's live installation outright (the token revoked or regenerated, the bot deleted), the project has Automatic Failover switched on, a standby bot is registered and its last probe found it healthy, and the Project Bot allowance permits: the platform writes the standby's credentials into the project's installation, resolves the incident, closes the connector outage as replaced, and emails every member reachable by email their new link on the creator's behalf, at the per-email fee accepted when the switch was armed. This event fires the moment the switch completes; it sits under a recovery whose recovery.operation_started carries automatic: true, and the Project Bot allowance is spent exactly as by a manual relink.

Required ability

project-recovery:view — token must carry this at mint time to subscribe an endpoint to this event.

Payload

{
  "id": "evt_01HX...",
  "type": "recovery.installation_failed_over",
  "created_at": "2026-09-14T03:19:42Z",
  "api_version": "2026-05-01",
  "project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13",
  "data": {
    "connector": "telegram",
    "installation_id": "3b8f0c6e-2d41-4a97-9e5f-1c7d6b2a8e40",
    "members_emailed": 214,
    "operation_id": "9a4d2e71-5b38-4c6f-8e12-3d7c9b0a5f21",
    "project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13",
    "replaced_at": "2026-09-14T03:19:41Z"
  }
}

Field reference

Field	Type	Notes
`id`	string ULID	Unique event id, prefixed `evt_`. Use for idempotent processing.
`type`	string	Always `recovery.installation_failed_over` for this event.
`created_at`	ISO 8601 timestamp	Server-side emission time.
`api_version`	string	Webhook API contract version.
`project_id`	string UUID	Project this event belongs to.
`data.connector`	string	The connector the installations live on.
`data.installation_id`	string UUID	The project's live installation, now carrying the standby's credentials; the same row as before.
`data.members_emailed`	integer	How many members were emailed their new link; `0` when nobody had a verified or billing address.
`data.operation_id`	string UUID	The recovery the switch ran under, marked automatic.
`data.project_id`	string UUID	Mirrors top-level `project_id`.
`data.replaced_at`	ISO 8601 timestamp	When the switch completed, as recorded in the ledger.

The switch cannot be undone from the dashboard: the refused bot is gone as far as the platform is concerned. The standby slot is empty afterwards, so the creator is asked to register a new standby bot.

Caveats

Fires only for a platform-caused refusal. A rate limit or a passing API error marks the installation degraded but never triggers a failover.
When a condition fails (plan lapsed, no healthy standby, allowance spent, or the switch refused), nothing fires here; the creator receives Automatic failover did not run for <project>'s bot by email and on their connected account, and the incident stays open.

recovery.resource_failed_over — the channel-side twin.
recovery.operation_started / recovery.operation_completed — the recovery around the switch.
connector.outage_closed — the outage this switch ends as replaced.
Recovery events overview — back to family overview.