Telegram

A Telegram channel type sends each alert as a message from your own bot to one chat, group, or channel. It is the only chat destination here with no webhook; you supply a bot token and a chat id instead.

Prerequisites

• The website Manager role in CentralCSP.
• A Telegram account.

1. Create a bot with BotFather

1. In Telegram, open a chat with @BotFather (Telegram's official bot for creating bots).
2. Send /newbot, then follow the prompts to pick a display name and a username. The username must end in bot.
3. Copy the bot token from BotFather's reply. It looks like 1234567890:AAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.

Telegram's reference is at BotFather. Treat the token as a secret; anyone holding it controls the bot. CentralCSP stores it and never returns it through the API.

2. Put the bot in the destination chat

The Bot API only lets a bot message chats it belongs to:

• Group: add the bot as a member.
• Channel: add the bot as an administrator with permission to post.
• Direct message: open a chat with the bot and send it /start. A bot cannot message a user first.

3. Find the chat id

For a public group or channel, the @username is the chat id; use it as-is.

For a private group or a direct message, the id is numeric:

1. Send any message in the destination chat (in a group, mention the bot or make it admin so it sees messages).
2. Open https://api.telegram.org/bot<TOKEN>/getUpdates in a browser, with <TOKEN> replaced by your bot token.
3. Read chat.id from the JSON response. A group id is negative and usually starts with -100.

4. Add the channel in CentralCSP

1. In the dashboard, go to Alerts > Configuration > Add channel.
2. Name the channel, choose the Telegram type, and paste the bot token and the chat id.
3. Save.

Both fields are validated as you type: the token must match the <bot id>:<secret> shape, and the chat id must be a number or a public @username.

5. Test the channel

Select Test on the new channel. A sample alert built from a fake CSP violation is sent immediately.

If the message does not arrive, the Bot API refused the send. A wrong chat id, a revoked token, or a bot that was removed from the chat all fail permanently; fix the destination and test again.

Next steps

• Create a rule that delivers to this channel.
• Channels overview for auto-disable behaviour and limits.
• Delivery history to audit what was sent.