GET /api/v1/alerts/incidents
GET /api/v1/alerts/incidents/{id}
alerts.read.
Query parameters of the list
| Param | Type | Notes |
|---|---|---|
scope | string | active (default) returns incidents with the status open or acknowledged. all returns the incidents created within the window and every active incident, however old. |
window_secs | integer | The look-back window of scope=all. Default 604800 (7 days). The value is clamped to 3600 through 31536000. |
triggering_query is null, and trace_ids, host_ids, and affected_services hold at most one value. Get the incident for the full record.
curl "http://localhost:5080/api/v1/alerts/incidents?scope=all&window_secs=86400" \
-H "authorization: Bearer $MS_JWT"
[
{
"id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
"org_id": "<organization-id>",
"rule_id": "3KEDBLvTYO6DnWi8H9S9MNLpPT7",
"escalation_policy_id": "<policy-id>",
"status": "resolved",
"severity": "critical",
"summary": "High error rate · checkout",
"fingerprint": "2b7f5329675de7077c74ffa2646a36cd3adf16f80f523270332894d1ff630632",
"current_step": 0,
"current_loop": 0,
"current_step_started_at": 1790000000000000,
"assignees": [],
"labels": { "service": "checkout", "team": "checkout" },
"annotations": {},
"trace_ids": [],
"host_ids": [],
"affected_services": ["checkout"],
"triggering_query": null,
"created_at": 1790000000000000,
"acknowledged_at": 1790000060000000,
"acknowledged_by": "<user-id>",
"resolved_at": 1790000300000000,
"resolved_by": "<user-id>"
}
]
Incident fields
| Field | Notes |
|---|---|
id, org_id, rule_id | The incident, organization, and rule identifiers. |
escalation_policy_id | Copied from the rule when the incident opens. The alias default becomes the id of the policy named default when escalation starts. |
status | open, acknowledged, or resolved. The model also has closed, and no call sets it. |
severity | info, warning, error, or critical. |
summary | The rule name, followed by up to two affected services and +N for more. |
fingerprint | A hash of the rule id and its labels. A rule has one active incident per fingerprint. |
current_step, current_loop, current_step_started_at | The escalation progress. The step number starts at 0, and the time is in microseconds. |
assignees | The users the incident is assigned to: the direct targets of the current escalation step, which are its user targets and the on-call user of each schedule target, plus the user who acknowledged the incident. Empty until the first step runs. A step that targets only teams keeps the earlier assignees. |
labels, annotations | A snapshot taken when the incident opens. The rule labels, plus service and host from the query result. Later rule edits do not change the snapshot. |
trace_ids, host_ids, affected_services | Values of the trace_id, host, and service columns of the query result, deduplicated. At most 10 values each. |
triggering_query | language, statement, and sample_values. Each sample has ts in microseconds (0 when the result has no time column), value, and labels. Only the get call returns it. |
created_at | When the incident opened, in microseconds. |
acknowledged_at, acknowledged_by | The time and user of the latest acknowledgement. |
resolved_at, resolved_by | The time and user of the resolution. resolved_by is null when the evaluator resolved the incident because the rule stopped matching. |
| Status | Cause |
|---|---|
403 | The token lacks alerts.read. |
404 | The incident does not exist. |