> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Open an incident

> Open an incident by hand that pages and escalates like any other.

```http theme={null}
POST /api/v1/alerts/incidents
```

Opens an incident for a problem no rule caught, such as a customer's report. The incident carries the
label `alert.source=manual`, the annotations `created_by` (the caller) and `description`, and the
`rule_id` `manual`. It skips alert pipelines, is never deduplicated with another incident, and never
recovers by itself. This call requires `alerts.incidents.create` and records the audit event
`alert.incident.created`.

**Request body**

| Field | Type | Required | Description |
| - | - | - | - |
| `title` | string | Yes | Up to 200 characters. |
| `description` | string | No | Markdown, up to 20000 characters. |
| `severity` | string | No | `info`, `warning`, `error` (default), or `critical`. |
| `urgency` | string | No | The key of one of the organization's [urgency levels](https://docs.molesignal.com/en-US/alerting/on-call.md#urgency-and-priority-levels), such as `high` or `low`; when left out, the incident's escalation policy decides, see [Urgency](https://docs.molesignal.com/en-US/alerting/on-call.md#urgency). |
| `priority` | string | No | One of the organization's priorities, `P1` to `P5` by default (at most `P9`). |
| `assign` | object | No | Who takes it; `{"kind": "auto"}` by default, routed by [alert routing](https://docs.molesignal.com/en-US/alerting/routing.md). `{"kind": "team", "team_id": "..."}` takes the team's on-call policy; `{"kind": "policy", "escalation_policy_id": "..."}` that policy; `{"kind": "users", "user_ids": [...]}` notifies 1 to 10 members of the organization directly, with no escalation policy. |
| `services` | string\[] | No | The affected services, up to 20. |
| `labels` | object | No | Up to 50 labels; `alert.source` is always `manual`. |
| `declare_major` | boolean | No | Also declares a [major incident](https://docs.molesignal.com/en-US/alerting/major-incidents.md). The incident is opened even when that fails. |

```bash cURL theme={null}
curl -X POST http://localhost:5080/api/v1/alerts/incidents \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"title": "Customers in the north cannot pay", "severity": "critical", "priority": "P1", "assign": {"kind": "team", "team_id": "<team-id>"}}'
```

The response is the incident; see [List incidents](https://docs.molesignal.com/en-US/api/alerting/list-incidents.md) for its fields.

**Errors**

| Status | Reason |
| - | - |
| `400` | The title is missing or too long, there are too many labels or services, `users` names not 1 to 10 people, or the team, policy, or people are not in the organization. |
| `403` | The token lacks `alerts.incidents.create`. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.