Act on incidents in bulk

curl -X POST http://localhost:5080/api/v1/alerts/incidents/bulk \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"ids": ["<incident-id>", "<another-incident-id>"], "action": "snooze", "duration_secs": 3600}'

{
  "results": [
    {
      "id": "3KEDNEyqouYJeBDTLTMTBui7XHW"
    },
    {
      "id": "3KEDQ4mJ8sLp2Xv6Nc1Rt9bYwHe",
      "error": "this incident is no longer active"
    }
  ]
}

curl -X POST http://localhost:5080/api/v1/alerts/incidents/bulk \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"ids": ["<incident-id>", "<another-incident-id>"], "action": "snooze", "duration_secs": 3600}'

{
  "results": [
    {
      "id": "3KEDNEyqouYJeBDTLTMTBui7XHW"
    },
    {
      "id": "3KEDQ4mJ8sLp2Xv6Nc1Rt9bYwHe",
      "error": "this incident is no longer active"
    }
  ]
}

POST /api/v1/alerts/incidents/bulk

Does one action to each incident in ids, one incident at a time: an incident that cannot be handled does not stop the others. action names what to do, with the fields it needs beside it:

`action`	Fields	Does what
`acknowledge`	None	As Acknowledge an incident.
`resolve`	None	As Resolve an incident.
`snooze`	`duration_secs`	As Snooze an incident.
`reassign`	`to`, the body of Reassign an incident	As that call.
`set_severity`	`severity`	As Set an incident’s severity.

The call requires alerts.incidents.acknowledge, and each incident is checked as the single calls check it. Merging is not a bulk action; use Merge incidents. Body

Field	Type	Required	Notes
`ids`	array	Yes	1 to 100 incident IDs; repeated IDs count once.
`action`	string	Yes	`acknowledge`, `resolve`, `snooze`, `reassign`, or `set_severity`.

curl -X POST http://localhost:5080/api/v1/alerts/incidents/bulk \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"ids": ["<incident-id>", "<another-incident-id>"], "action": "snooze", "duration_secs": 3600}'

The response has one result per incident: id, and error when it was not handled, for example because it recovered or because duration_secs is out of range.

{
  "results": [
    {
      "id": "3KEDNEyqouYJeBDTLTMTBui7XHW"
    },
    {
      "id": "3KEDQ4mJ8sLp2Xv6Nc1Rt9bYwHe",
      "error": "this incident is no longer active"
    }
  ]
}

Errors

Status	Cause
`400`	`ids` is empty or has more than 100 incidents.
`403`	The token lacks `alerts.incidents.acknowledge`.
`422`	`action` is missing or unknown, or a field it needs is missing.

Last modified on October 31, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration