Acknowledge an incident

curl -X POST http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/ack \
  -H "authorization: Bearer $MS_JWT"

{
  "id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "rule_id": "3KEDBLvTYO6DnWi8H9S9MNLpPT7",
  "escalation_policy_id": "<policy-id>",
  "status": "acknowledged",
  "severity": "critical",
  "summary": "High error rate · checkout",
  "fingerprint": "2b7f5329675de7077c74ffa2646a36cd3adf16f80f523270332894d1ff630632",
  "current_step": 0,
  "current_loop": 0,
  "current_step_started_at": 1790000000000000,
  "assignees": [],
  "labels": { "service": "checkout", "team": "checkout" },
  "annotations": {},
  "trace_ids": [],
  "host_ids": [],
  "affected_services": ["checkout"],
  "triggering_query": {
    "language": "sql",
    "statement": "SELECT count(*) AS c FROM app WHERE level = 'error'",
    "sample_values": [{ "ts": 0, "value": 120.0, "labels": { "c": "120" } }]
  },
  "created_at": 1790000000000000,
  "acknowledged_at": 1790000060000000,
  "acknowledged_by": "<user-id>",
  "resolved_at": null,
  "resolved_by": null
}

curl -X POST http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/ack \
  -H "authorization: Bearer $MS_JWT"

{
  "id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "rule_id": "3KEDBLvTYO6DnWi8H9S9MNLpPT7",
  "escalation_policy_id": "<policy-id>",
  "status": "acknowledged",
  "severity": "critical",
  "summary": "High error rate · checkout",
  "fingerprint": "2b7f5329675de7077c74ffa2646a36cd3adf16f80f523270332894d1ff630632",
  "current_step": 0,
  "current_loop": 0,
  "current_step_started_at": 1790000000000000,
  "assignees": [],
  "labels": { "service": "checkout", "team": "checkout" },
  "annotations": {},
  "trace_ids": [],
  "host_ids": [],
  "affected_services": ["checkout"],
  "triggering_query": {
    "language": "sql",
    "statement": "SELECT count(*) AS c FROM app WHERE level = 'error'",
    "sample_values": [{ "ts": 0, "value": 120.0, "labels": { "c": "120" } }]
  },
  "created_at": 1790000000000000,
  "acknowledged_at": 1790000060000000,
  "acknowledged_by": "<user-id>",
  "resolved_at": null,
  "resolved_by": null
}

POST /api/v1/alerts/incidents/{id}/ack

Acknowledges one open incident. The call sets the status to acknowledged, records the calling user and the time in acknowledged_by and acknowledged_at, adds the user to assignees, and stops escalation, because only open incidents advance through an escalation policy. The call also marks the triggered notification as acknowledged and sends an alert.acknowledged event. It requires alerts.acknowledge, and the body is empty. An acknowledged incident stays acknowledged until a user resolves it. The evaluator does not resolve it, even when the rule stops matching.

Acknowledging an incident that is already acknowledged returns it unchanged. The first user and time stay in acknowledged_by and acknowledged_at, and no event is sent again. Acknowledging a resolved or closed incident answers 409, and the incident keeps its status.

curl -X POST http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/ack \
  -H "authorization: Bearer $MS_JWT"

The response is the updated incident. List incidents describes every field.

{
  "id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "rule_id": "3KEDBLvTYO6DnWi8H9S9MNLpPT7",
  "escalation_policy_id": "<policy-id>",
  "status": "acknowledged",
  "severity": "critical",
  "summary": "High error rate · checkout",
  "fingerprint": "2b7f5329675de7077c74ffa2646a36cd3adf16f80f523270332894d1ff630632",
  "current_step": 0,
  "current_loop": 0,
  "current_step_started_at": 1790000000000000,
  "assignees": [],
  "labels": { "service": "checkout", "team": "checkout" },
  "annotations": {},
  "trace_ids": [],
  "host_ids": [],
  "affected_services": ["checkout"],
  "triggering_query": {
    "language": "sql",
    "statement": "SELECT count(*) AS c FROM app WHERE level = 'error'",
    "sample_values": [{ "ts": 0, "value": 120.0, "labels": { "c": "120" } }]
  },
  "created_at": 1790000000000000,
  "acknowledged_at": 1790000060000000,
  "acknowledged_by": "<user-id>",
  "resolved_at": null,
  "resolved_by": null
}

Errors

Status	Cause
`403`	The token lacks `alerts.acknowledge`.
`404`	The incident does not exist.

Last modified on October 9, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration