Root cause analysis

curl -X POST "http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/rca?locale=en-us" \
  -H "authorization: Bearer $MS_JWT"

{
  "incident_id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "summary": "# Root-Cause Analysis — High error rate · checkout\n\n## Summary\n\n...",
  "provider": "openai_compatible",
  "model": "<model-name>",
  "prompt_builtin_key": "analysis.root_cause",
  "prompt_hash": "cc4b0b3bccf9e24bb4590ca854cf524cfd07af6ae902797ad2dc108b6726e62c",
  "prompt_tokens": 412,
  "completion_tokens": 506,
  "finish_reason": "stop",
  "created_at": 1790000120000000,
  "updated_at": 1790000120000000
}

curl -X POST "http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/rca?locale=en-us" \
  -H "authorization: Bearer $MS_JWT"

{
  "incident_id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "summary": "# Root-Cause Analysis — High error rate · checkout\n\n## Summary\n\n...",
  "provider": "openai_compatible",
  "model": "<model-name>",
  "prompt_builtin_key": "analysis.root_cause",
  "prompt_hash": "cc4b0b3bccf9e24bb4590ca854cf524cfd07af6ae902797ad2dc108b6726e62c",
  "prompt_tokens": 412,
  "completion_tokens": 506,
  "finish_reason": "stop",
  "created_at": 1790000120000000,
  "updated_at": 1790000120000000
}

GET /api/v1/alerts/incidents/{id}/rca
POST /api/v1/alerts/incidents/{id}/rca

Mole Agent writes a root cause analysis (RCA) for an incident from the incident context. Each incident has at most one analysis. The alert role creates analyses automatically. Every three minutes, the role writes an analysis for active incidents that have none, up to 20 per pass, when the organization has an enabled model provider with an API key. The GET call reads the stored analysis. The POST call generates a new analysis immediately and replaces the stored one.

Call	Permission	Notes
`GET`	`alerts.read`	Answers `404` with `no root-cause analysis for this incident yet` until an analysis exists.
`POST`	`alerts.manage`	Waits for the model and returns the new analysis. The optional query parameter `locale` selects the output language, `en-us` or `zh-cn`. The default is the language preference of the calling user.

curl -X POST "http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/rca?locale=en-us" \
  -H "authorization: Bearer $MS_JWT"

{
  "incident_id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "summary": "# Root-Cause Analysis — High error rate · checkout\n\n## Summary\n\n...",
  "provider": "openai_compatible",
  "model": "<model-name>",
  "prompt_builtin_key": "analysis.root_cause",
  "prompt_hash": "cc4b0b3bccf9e24bb4590ca854cf524cfd07af6ae902797ad2dc108b6726e62c",
  "prompt_tokens": 412,
  "completion_tokens": 506,
  "finish_reason": "stop",
  "created_at": 1790000120000000,
  "updated_at": 1790000120000000
}

Response

Field	Notes
`incident_id`, `org_id`	The incident and organization identifiers.
`summary`	The analysis, as Markdown text.
`provider`, `model`	The model provider type, such as `openai`, `anthropic`, or `openai_compatible`, and the model name.
`prompt_builtin_key`, `prompt_hash`	The prompt template and a hash of the rendered prompt, for audit.
`prompt_tokens`, `completion_tokens`, `finish_reason`	Token usage and the finish reason that the provider reports.
`created_at`, `updated_at`	Microseconds since the Unix epoch. `updated_at` changes when the analysis is regenerated.

Errors

Status	Cause
`400`	The `POST` call found no enabled model provider with an API key for the organization.
`403`	The token lacks the permission of the call.
`404`	The incident does not exist, or the `GET` call found no analysis yet.

Last modified on October 9, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration