GET /api/v1/alerts/incidents/{id}/timeline
alerts.incidents.read. The console builds the
incident’s timeline from it.
| Field | Content |
|---|---|
entries | The recorded steps, oldest first: id, org_id, incident_id, at in microseconds, kind, actor (the user ID, null for MoleSignal itself), and detail. |
deliveries | The notifications of the incident, oldest first, at most 500: id, event_id (alert.triggered:…, alert.escalated:…, alert.acknowledged:…, or alert.resolved:…), user_id, connector_id, target (masked), stage, status, error, created_at, and delivered_at. A policy that a pipeline kept from sending has status skipped, no user_id or connector_id, and the reason as error. |
merged | The incidents merged into this one: id, summary, status, severity, created_at, and resolved_at. |
kind | detail |
|---|---|
acknowledged, resolved | via: web, api, im, sms, phone, or agent. |
escalated | step (from 0), loop, reason, and the step’s targets. |
reassigned | to, as in Reassign an incident, and from: the earlier assignees, team, and policy. |
responders_added | user_ids. |
snoozed | until in microseconds and duration_secs. |
snooze_cancelled | Empty. |
retriggered | reason: snooze_ended or ack_timeout. |
severity_changed | from and to. |
merged | into: the incident it was merged into. |
merged_in | incidents: the incidents merged into this one. |
merged_recovered | incident_id and summary of a merged incident that recovered. |
note | text and via. |
remediation_requested | A remediation action was requested: the run run_id, the action name action, and the filled-in inputs. |
remediation_executed | A remediation action finished: run_id, action, status (succeeded or failed), and output (the start of the response or the error). |
remediation_verified | The check after a run: run_id, action, passed, and how it was checked, by (incident_resolved or rule_healthy). |
ticket_created | A ticket was created: system (jira or meegle), key, url, and the connector name connector. |
ticket_updated | A sync found the ticket’s status changed: key, status, and done. |
declared_major | Declared a major incident; auto is true when the organization’s rule declared it. |
role_assigned | A role was assigned: role (commander, communications, or scribe) and user_id, null when it was cleared. |
war_room_created | The war room was made: platform, the join link url, and the meeting link meeting_url. |
task_added, task_done | A task was added, or one was done: title. |
status_update | An update was posted: impact, current, and next. |
pipeline_processed | An alert pipeline changed the event before the incident opened, or failed: pipeline_id, pipeline, changes (each with field, such as severity or labels.team, from, absent for what was added, and to, absent for what was removed), more, how many more changes there were than the 40 listed, and error. |
curl -X GET http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/timeline \
-H "authorization: Bearer $MS_TOKEN"
{
"entries": [
{
"id": "3KEE0Q1v9mYtHb7c2Lr8Wk5dPzA",
"org_id": "<organization-id>",
"incident_id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
"at": 1790000120000000,
"kind": "acknowledged",
"actor": "<user-id>",
"detail": {
"via": "sms"
}
},
{
"id": "3KEE1aXy7pRtGd2s9Lm4Qv8bNcE",
"org_id": "<organization-id>",
"incident_id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
"at": 1790000300000000,
"kind": "note",
"actor": "<user-id>",
"detail": {
"text": "Rolled back the edge proxy.",
"via": "web"
}
}
],
"deliveries": [
{
"id": "<delivery-id>",
"event_id": "alert.triggered:3KEDNEyqouYJeBDTLTMTBui7XHW",
"user_id": "<user-id>",
"connector_id": "<connector-id>",
"target": "+86138****8000",
"stage": "user_primary",
"status": "delivered",
"error": null,
"created_at": 1790000001000000,
"delivered_at": 1790000002000000
}
],
"merged": [
{
"id": "3KEDQ4mJ8sLp2Xv6Nc1Rt9bYwHe",
"summary": "Checkout p95 above 800 ms",
"status": "open",
"severity": "error",
"created_at": 1790000030000000,
"resolved_at": null
}
]
}
| Status | Cause |
|---|---|
403 | The token lacks alerts.incidents.read. |
404 | The incident does not exist. |