Obtain a Honeycomb API key with appropriate permissions from Environment Settings and note the dataset name
Create a derived column via POST to 'https://api.honeycomb.io/1/derived_columns/{dataset}' with header 'X-Honeycomb-Team: YOUR_KEY' and body '{"alias": "column_name", "expression": "MATH(field_a, field_b)", "description": "..."}' using Honeycomb's expression language
Create a trigger via POST to 'https://api.honeycomb.io/1/triggers/{dataset}' with body containing 'name', 'description', 'threshold' object (op and value), 'frequency' (evaluation interval in seconds), and 'query' object with a Honeycomb query specification
Define the trigger 'query' with 'calculations' (e.g. P99 of a duration field), optional 'filters', 'breakdowns', and 'time_range' to specify what is evaluated
Add 'recipients' array to the trigger body to route notifications (type: 'email', 'pagerduty', 'slack', or 'webhook') and enable the trigger with 'enabled': true
Known gotchas
Derived column expressions use Honeycomb's own expression syntax, not SQL or PromQL; referencing a field that does not exist in an event returns null rather than an error, silently skewing aggregations
Trigger frequency must be a multiple of 60 seconds and within allowed bounds; values outside the permitted range return a validation error without listing valid options
Triggers evaluate a fixed lookback window at each interval; if event ingestion latency exceeds the lookback window, recent events may be missed in the evaluation
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp