> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get an incident's timeline

> Read what was done to an incident, the notifications it sent, and the incidents merged into it.

```http theme={null}
GET /api/v1/alerts/incidents/{id}/timeline
```

Returns what happened to one incident: the steps that people and MoleSignal recorded, the notifications
sent about it, and the incidents merged into it. The call requires `alerts.incidents.read`. The console builds the
incident's [timeline](https://docs.molesignal.com/en-US/alerting/incidents.md#incident-details) from it.

| Field | Content |
| - | - |
| `entries` | The recorded steps, oldest first: `id`, `org_id`, `incident_id`, `at` in microseconds, `kind`, `actor` (the user ID, `null` for MoleSignal itself), and `detail`. |
| `deliveries` | The notifications of the incident, oldest first, at most 500: `id`, `event_id` (`alert.triggered:…`, `alert.escalated:…`, `alert.acknowledged:…`, or `alert.resolved:…`), `user_id`, `connector_id`, `target` (masked), `stage`, `status`, `error`, `created_at`, and `delivered_at`. A policy that a [pipeline kept from sending](https://docs.molesignal.com/en-US/pipelines/alert-events.md#before-a-notification) has `status` `skipped`, no `user_id` or `connector_id`, and the reason as `error`. |
| `merged` | The incidents [merged](https://docs.molesignal.com/en-US/api/alerting/merge-incidents.md) into this one: `id`, `summary`, `status`, `severity`, `created_at`, and `resolved_at`. |

| `kind` | `detail` |
| - | - |
| `acknowledged`, `resolved` | `via`: `web`, `api`, `im`, `sms`, `phone`, or `agent`. |
| `escalated` | `step` (from 0), `loop`, `reason`, and the step's `targets`. |
| `reassigned` | `to`, as in [Reassign an incident](https://docs.molesignal.com/en-US/api/alerting/reassign-incident.md), and `from`: the earlier assignees, team, and policy. |
| `responders_added` | `user_ids`. |
| `snoozed` | `until` in microseconds and `duration_secs`. |
| `snooze_cancelled` | Empty. |
| `retriggered` | `reason`: `snooze_ended` or `ack_timeout`. |
| `severity_changed` | `from` and `to`. |
| `merged` | `into`: the incident it was merged into. |
| `merged_in` | `incidents`: the incidents merged into this one. |
| `merged_recovered` | `incident_id` and `summary` of a merged incident that recovered. |
| `note` | `text` and `via`. |
| `remediation_requested` | A [remediation action](https://docs.molesignal.com/en-US/api/alerting/remediation.md) was requested: the run `run_id`, the action name `action`, and the filled-in `inputs`. |
| `remediation_executed` | A remediation action finished: `run_id`, `action`, `status` (`succeeded` or `failed`), and `output` (the start of the response or the error). |
| `remediation_verified` | The check after a run: `run_id`, `action`, `passed`, and how it was checked, `by` (`incident_resolved` or `rule_healthy`). |
| `ticket_created` | A [ticket](https://docs.molesignal.com/en-US/api/alerting/tickets.md) was created: `system` (`jira` or `meegle`), `key`, `url`, and the connector name `connector`. |
| `ticket_updated` | A sync found the ticket's status changed: `key`, `status`, and `done`. |
| `declared_major` | Declared a [major incident](https://docs.molesignal.com/en-US/api/alerting/major-incidents.md); `auto` is `true` when the organization's rule declared it. |
| `role_assigned` | A role was assigned: `role` (`commander`, `communications`, or `scribe`) and `user_id`, `null` when it was cleared. |
| `war_room_created` | The war room was made: `platform`, the join link `url`, and the meeting link `meeting_url`. |
| `task_added`, `task_done` | A task was added, or one was done: `title`. |
| `status_update` | An update was posted: `impact`, `current`, and `next`. |
| `pipeline_processed` | An [alert pipeline](https://docs.molesignal.com/en-US/pipelines/alert-events.md#what-becomes-of-an-event) changed the event before the incident opened, or failed: `pipeline_id`, `pipeline`, `changes` (each with `field`, such as `severity` or `labels.team`, `from`, absent for what was added, and `to`, absent for what was removed), `more`, how many more changes there were than the 40 listed, and `error`. |

```bash cURL theme={null}
curl -X GET http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/timeline \
  -H "authorization: Bearer $MS_TOKEN"
```

The response has the three lists.

```json 200 theme={null}
{
  "entries": [
    {
      "id": "3KEE0Q1v9mYtHb7c2Lr8Wk5dPzA",
      "org_id": "<organization-id>",
      "incident_id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
      "at": 1790000120000000,
      "kind": "acknowledged",
      "actor": "<user-id>",
      "detail": {
        "via": "sms"
      }
    },
    {
      "id": "3KEE1aXy7pRtGd2s9Lm4Qv8bNcE",
      "org_id": "<organization-id>",
      "incident_id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
      "at": 1790000300000000,
      "kind": "note",
      "actor": "<user-id>",
      "detail": {
        "text": "Rolled back the edge proxy.",
        "via": "web"
      }
    }
  ],
  "deliveries": [
    {
      "id": "<delivery-id>",
      "event_id": "alert.triggered:3KEDNEyqouYJeBDTLTMTBui7XHW",
      "user_id": "<user-id>",
      "connector_id": "<connector-id>",
      "target": "+86138****8000",
      "stage": "user_primary",
      "status": "delivered",
      "error": null,
      "created_at": 1790000001000000,
      "delivered_at": 1790000002000000
    }
  ],
  "merged": [
    {
      "id": "3KEDQ4mJ8sLp2Xv6Nc1Rt9bYwHe",
      "summary": "Checkout p95 above 800 ms",
      "status": "open",
      "severity": "error",
      "created_at": 1790000030000000,
      "resolved_at": null
    }
  ]
}
```

**Errors**

| Status | Cause |
| - | - |
| `403` | The token lacks `alerts.incidents.read`. |
| `404` | The incident does not exist. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.