Reassign an incident

curl -X POST http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/reassign \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"kind": "users", "user_ids": ["<user-id>"]}'

{
  "id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "rule_id": "3KEDBLvTYO6DnWi8H9S9MNLpPT7",
  "escalation_policy_id": "<policy-id>",
  "status": "open",
  "severity": "critical",
  "summary": "High error rate · checkout",
  "fingerprint": "2b7f5329675de7077c74ffa2646a36cd3adf16f80f523270332894d1ff630632",
  "current_step": 0,
  "current_loop": 0,
  "current_step_started_at": 1790000300000000,
  "assignees": [
    "<user-id>"
  ],
  "labels": {
    "service": "checkout"
  },
  "annotations": {},
  "trace_ids": [],
  "host_ids": [],
  "affected_services": [
    "checkout"
  ],
  "created_at": 1790000000000000,
  "acknowledged_at": null,
  "acknowledged_by": null,
  "resolved_at": null,
  "resolved_by": null,
  "team_id": "<team-id>",
  "routing": {
    "reason": "default"
  },
  "snoozed_until": null,
  "snoozed_by": null,
  "assignees_pinned": true,
  "severity_set_by": null,
  "merged_into": null,
  "dispatch_round": 1,
  "dispatch_reason": "reassigned",
  "revision": 4
}

curl -X POST http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/reassign \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"kind": "users", "user_ids": ["<user-id>"]}'

{
  "id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "rule_id": "3KEDBLvTYO6DnWi8H9S9MNLpPT7",
  "escalation_policy_id": "<policy-id>",
  "status": "open",
  "severity": "critical",
  "summary": "High error rate · checkout",
  "fingerprint": "2b7f5329675de7077c74ffa2646a36cd3adf16f80f523270332894d1ff630632",
  "current_step": 0,
  "current_loop": 0,
  "current_step_started_at": 1790000300000000,
  "assignees": [
    "<user-id>"
  ],
  "labels": {
    "service": "checkout"
  },
  "annotations": {},
  "trace_ids": [],
  "host_ids": [],
  "affected_services": [
    "checkout"
  ],
  "created_at": 1790000000000000,
  "acknowledged_at": null,
  "acknowledged_by": null,
  "resolved_at": null,
  "resolved_by": null,
  "team_id": "<team-id>",
  "routing": {
    "reason": "default"
  },
  "snoozed_until": null,
  "snoozed_by": null,
  "assignees_pinned": true,
  "severity_set_by": null,
  "merged_into": null,
  "dispatch_round": 1,
  "dispatch_reason": "reassigned",
  "revision": 4
}

POST /api/v1/alerts/incidents/{id}/reassign

Gives an active incident to someone else. The body names the new owner with kind:

users: the people in user_ids, 1 to 10 members of the organization, become the assignees and receive an escalation notification whose escalation.reason is reassigned. The incident goes back to open, and its current step starts its ack timeout again; when nobody acknowledges, escalation goes on to the next step.
team: the team in team_id takes the incident, which moves to the team’s on-call policy, or to the policy named default when the team has none, and starts again from its first step that applies.
policy: the incident moves to the policy in escalation_policy_id and starts again from its first step that applies; the team stays.

The incident goes back to open in each case, a snooze ends, and the step is recorded on the timeline. The call requires alerts.incidents.update. Body

Field	Type	Required	Notes
`kind`	string	Yes	`users`, `team`, or `policy`.
`user_ids`	array	With `users`	1 to 10 user IDs of members of the organization.
`team_id`	string	With `team`	The team.
`escalation_policy_id`	string	With `policy`	The policy.

curl -X POST http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/reassign \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"kind": "users", "user_ids": ["<user-id>"]}'

The response is the updated incident. List incidents describes every field.

{
  "id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "rule_id": "3KEDBLvTYO6DnWi8H9S9MNLpPT7",
  "escalation_policy_id": "<policy-id>",
  "status": "open",
  "severity": "critical",
  "summary": "High error rate · checkout",
  "fingerprint": "2b7f5329675de7077c74ffa2646a36cd3adf16f80f523270332894d1ff630632",
  "current_step": 0,
  "current_loop": 0,
  "current_step_started_at": 1790000300000000,
  "assignees": [
    "<user-id>"
  ],
  "labels": {
    "service": "checkout"
  },
  "annotations": {},
  "trace_ids": [],
  "host_ids": [],
  "affected_services": [
    "checkout"
  ],
  "created_at": 1790000000000000,
  "acknowledged_at": null,
  "acknowledged_by": null,
  "resolved_at": null,
  "resolved_by": null,
  "team_id": "<team-id>",
  "routing": {
    "reason": "default"
  },
  "snoozed_until": null,
  "snoozed_by": null,
  "assignees_pinned": true,
  "severity_set_by": null,
  "merged_into": null,
  "dispatch_round": 1,
  "dispatch_reason": "reassigned",
  "revision": 4
}

Errors

Status	Cause
`400`	`user_ids` is empty, has more than 10 users, or names a user outside the organization; or the team has no policy and there is no `default` policy; or no step of the policy applies to the incident’s severity.
`403`	The token lacks `alerts.incidents.update`, or the incident is out of the token’s reach.
`404`	The incident does not exist.
`409`	The incident has recovered or was merged into another, or it kept changing while it was being updated; retry.

Last modified on October 31, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration