Resolve an incident

curl -X POST http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/resolve \
  -H "authorization: Bearer $MS_JWT"

{
  "id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "rule_id": "3KEDBLvTYO6DnWi8H9S9MNLpPT7",
  "escalation_policy_id": "<policy-id>",
  "status": "resolved",
  "severity": "critical",
  "summary": "High error rate · checkout",
  "fingerprint": "2b7f5329675de7077c74ffa2646a36cd3adf16f80f523270332894d1ff630632",
  "current_step": 0,
  "current_loop": 0,
  "current_step_started_at": 1790000000000000,
  "assignees": [],
  "labels": { "service": "checkout", "team": "checkout" },
  "annotations": {},
  "trace_ids": [],
  "host_ids": [],
  "affected_services": ["checkout"],
  "triggering_query": {
    "language": "sql",
    "statement": "SELECT count(*) AS c FROM app WHERE level = 'error'",
    "sample_values": [{ "ts": 0, "value": 120.0, "labels": { "c": "120" } }]
  },
  "created_at": 1790000000000000,
  "acknowledged_at": 1790000060000000,
  "acknowledged_by": "<user-id>",
  "resolved_at": 1790000300000000,
  "resolved_by": "<user-id>"
}

curl -X POST http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/resolve \
  -H "authorization: Bearer $MS_JWT"

{
  "id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "rule_id": "3KEDBLvTYO6DnWi8H9S9MNLpPT7",
  "escalation_policy_id": "<policy-id>",
  "status": "resolved",
  "severity": "critical",
  "summary": "High error rate · checkout",
  "fingerprint": "2b7f5329675de7077c74ffa2646a36cd3adf16f80f523270332894d1ff630632",
  "current_step": 0,
  "current_loop": 0,
  "current_step_started_at": 1790000000000000,
  "assignees": [],
  "labels": { "service": "checkout", "team": "checkout" },
  "annotations": {},
  "trace_ids": [],
  "host_ids": [],
  "affected_services": ["checkout"],
  "triggering_query": {
    "language": "sql",
    "statement": "SELECT count(*) AS c FROM app WHERE level = 'error'",
    "sample_values": [{ "ts": 0, "value": 120.0, "labels": { "c": "120" } }]
  },
  "created_at": 1790000000000000,
  "acknowledged_at": 1790000060000000,
  "acknowledged_by": "<user-id>",
  "resolved_at": 1790000300000000,
  "resolved_by": "<user-id>"
}

POST /api/v1/alerts/incidents/{id}/resolve

Resolves one open or acknowledged incident. The call sets the status to resolved, records the calling user and the time in resolved_by and resolved_at, and stops escalation. The call also marks the triggered notification as acknowledged and sends an alert.resolved event. It requires alerts.acknowledge, and the body is empty. A rule that still matches opens a new incident at its next evaluation. Resolving an incident does not disable the rule.

Resolving an incident that is already resolved or closed returns it unchanged. The first user and time stay in resolved_by and resolved_at, and no event is sent again.

curl -X POST http://localhost:5080/api/v1/alerts/incidents/$INCIDENT_ID/resolve \
  -H "authorization: Bearer $MS_JWT"

The response is the updated incident. List incidents describes every field.

{
  "id": "3KEDNEyqouYJeBDTLTMTBui7XHW",
  "org_id": "<organization-id>",
  "rule_id": "3KEDBLvTYO6DnWi8H9S9MNLpPT7",
  "escalation_policy_id": "<policy-id>",
  "status": "resolved",
  "severity": "critical",
  "summary": "High error rate · checkout",
  "fingerprint": "2b7f5329675de7077c74ffa2646a36cd3adf16f80f523270332894d1ff630632",
  "current_step": 0,
  "current_loop": 0,
  "current_step_started_at": 1790000000000000,
  "assignees": [],
  "labels": { "service": "checkout", "team": "checkout" },
  "annotations": {},
  "trace_ids": [],
  "host_ids": [],
  "affected_services": ["checkout"],
  "triggering_query": {
    "language": "sql",
    "statement": "SELECT count(*) AS c FROM app WHERE level = 'error'",
    "sample_values": [{ "ts": 0, "value": 120.0, "labels": { "c": "120" } }]
  },
  "created_at": 1790000000000000,
  "acknowledged_at": 1790000060000000,
  "acknowledged_by": "<user-id>",
  "resolved_at": 1790000300000000,
  "resolved_by": "<user-id>"
}

Errors

Status	Cause
`403`	The token lacks `alerts.acknowledge`.
`404`	The incident does not exist.

Last modified on October 9, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration