Open an incident

curl -X POST http://localhost:5080/api/v1/alerts/incidents \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"title": "Customers in the north cannot pay", "severity": "critical", "priority": "P1", "assign": {"kind": "team", "team_id": "<team-id>"}}'

curl -X POST http://localhost:5080/api/v1/alerts/incidents \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"title": "Customers in the north cannot pay", "severity": "critical", "priority": "P1", "assign": {"kind": "team", "team_id": "<team-id>"}}'

POST /api/v1/alerts/incidents

Opens an incident for a problem no rule caught, such as a customer’s report. The incident carries the label alert.source=manual, the annotations created_by (the caller) and description, and the rule_id manual. It skips alert pipelines, is never deduplicated with another incident, and never recovers by itself. This call requires alerts.incidents.create and records the audit event alert.incident.created. Request body

Field	Type	Required	Description
`title`	string	Yes	Up to 200 characters.
`description`	string	No	Markdown, up to 20000 characters.
`severity`	string	No	`info`, `warning`, `error` (default), or `critical`.
`urgency`	string	No	The key of one of the organization’s urgency levels, such as `high` or `low`; when left out, the incident’s escalation policy decides, see Urgency.
`priority`	string	No	One of the organization’s priorities, `P1` to `P5` by default (at most `P9`).
`assign`	object	No	Who takes it; `{"kind": "auto"}` by default, routed by alert routing. `{"kind": "team", "team_id": "..."}` takes the team’s on-call policy; `{"kind": "policy", "escalation_policy_id": "..."}` that policy; `{"kind": "users", "user_ids": [...]}` notifies 1 to 10 members of the organization directly, with no escalation policy.
`services`	string[]	No	The affected services, up to 20.
`labels`	object	No	Up to 50 labels; `alert.source` is always `manual`.
`declare_major`	boolean	No	Also declares a major incident. The incident is opened even when that fails.

curl -X POST http://localhost:5080/api/v1/alerts/incidents \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"title": "Customers in the north cannot pay", "severity": "critical", "priority": "P1", "assign": {"kind": "team", "team_id": "<team-id>"}}'

The response is the incident; see List incidents for its fields. Errors

Status	Reason
`400`	The title is missing or too long, there are too many labels or services, `users` names not 1 to 10 people, or the team, policy, or people are not in the organization.
`403`	The token lacks `alerts.incidents.create`.

Last modified on October 31, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration