> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Root cause analysis

> Read or generate the AI root cause analysis of an incident.

```http theme={null}
GET /api/v1/alerts/incidents/{id}/rca
POST /api/v1/alerts/incidents/{id}/rca
```

[Mole Agent](https://docs.molesignal.com/en-US/agent) writes a root cause analysis (RCA) for an incident from the incident context. Each incident has at most one analysis.

The `alert` role creates analyses automatically. Every three minutes, the role writes an analysis for active incidents that have none, up to 20 per pass, when the organization has an enabled model provider with an API key. The `GET` call reads the stored analysis. The `POST` call generates a new analysis immediately and replaces the stored one.

| Call | Permission | Notes |
| - | - | - |
| `GET` | `alerts.read` | Answers `404` with `no root-cause analysis for this incident yet` until an analysis exists. |
| `POST` | `alerts.manage` | Waits for the model and returns the new analysis. The optional query parameter `locale` selects the output language, `en-us` or `zh-cn`. The default is the language preference of the calling user. |

```bash cURL theme={null}
curl -X POST "http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/rca?locale=en-us" \
  -H "authorization: Bearer $MS_JWT"
```

```json 200 theme={null}
{
  "incident_id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "summary": "# Root-Cause Analysis — High error rate · checkout\n\n## Summary\n\n...",
  "provider": "openai_compatible",
  "model": "<model-name>",
  "prompt_builtin_key": "analysis.root_cause",
  "prompt_hash": "cc4b0b3bccf9e24bb4590ca854cf524cfd07af6ae902797ad2dc108b6726e62c",
  "prompt_tokens": 412,
  "completion_tokens": 506,
  "finish_reason": "stop",
  "created_at": 1790000120000000,
  "updated_at": 1790000120000000
}
```

**Response**

| Field | Notes |
| - | - |
| `incident_id`, `org_id` | The incident and organization identifiers. |
| `summary` | The analysis, as Markdown text. |
| `provider`, `model` | The model provider type, such as `openai`, `anthropic`, or `openai_compatible`, and the model name. |
| `prompt_builtin_key`, `prompt_hash` | The prompt template and a hash of the rendered prompt, for audit. |
| `prompt_tokens`, `completion_tokens`, `finish_reason` | Token usage and the finish reason that the provider reports. |
| `created_at`, `updated_at` | Microseconds since the Unix epoch. `updated_at` changes when the analysis is regenerated. |

**Errors**

| Status | Cause |
| - | - |
| `400` | The `POST` call found no enabled model provider with an API key for the organization. |
| `403` | The token lacks the permission of the call. |
| `404` | The incident does not exist, or the `GET` call found no analysis yet. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.