Here are the key concepts required to make requests to the incident.io API.

For all requests made to the incident.io API, you'll need an API key.

To create an API key, head to the incident dashboard and visit API keys. When you create the key, you'll be able to choose what actions it can take for your account: choose carefully, as those roles can only be set when you first create the key. We'll only show you the token once, so make sure you store it somewhere safe.

Once you have the key, you should make requests to the API that set the Authorization request header using a "Bearer" authentication scheme:

Authorization: Bearer <YOUR_API_KEY>

We use standard HTTP response codes to indicate the status or failure of API requests.

The API response body will be JSON, and contain more detailed information on the nature of the error.

An example error when a request is made without an API key:

{
  "type": "authentication_error",
  "status": 401,
  "request_id": "8e3cc412-b49d-4957-9073-2c19d2c61804",
  "errors": [
    {
      "code": "missing_authorization_material",
      "message": "No authorization material provided in request"
    }
  ]
}

Note that the error:

• Contains the HTTP status (401)
• References the type of error (authentication_error)
• Includes a request_id that can be provided to incident.io support to help debug questions with your API request
• Provides a list of individual errors, which go into detail about why the error occurred

The most common error will be a 422 Validation Error, which is returned when the request was rejected due to failing validations.

These errors look like this:

{
  "type": "validation_error",
  "status": 422,
  "request_id": "631766c4-4afd-4803-997c-cd700928fa4b",
  "errors": [
    {
      "code": "is_required",
      "message": "A severity is required to open an incident",
      "source": {
        "field": "severity_id"
      }
    }
  ]
}

This error is caused by not providing a severity identifier, which should be at the severity_id field of the request payload. Errors like these can be mapped to forms, should you be integrating with the API from a user-interface.

Manage incident actions.

Incidents have two types of actions associated to them:

• Actions, used during an incident response as ephemeral todo lists
• Follow-ups, actions which are for after the incident and can be exported to external issue trackers

You can manage actions in the incident Slack channel with /incident actions, or on the incident homepage.

Exporting follow-ups to external issue trackers can be done in the incident homepage.

Manage custom fields.

Custom fields are used to attach metadata to incidents, which you can use when searching for incidents in the dashboard, triggering workflows, building announcement rules or for your own data needs.

Each field has a type:

• Single-select, single value selected from a predefined list of options (ie. Incident Type)
• Multi-select, as above but you can pick more than one option (ie. Teams)
• Text, freeform text field (ie. Customer ID)
• Link, link URL that is synced to Slack bookmarks on the incident channel (ie. External Status Page)
• Number, integer or fractional numbers (ie. Customers Affected)

We may add more custom field types in the future - we'd love to hear any other types you'd like to use!

Manage custom field options.

Single- and multi-select custom fields have a list of all available options, which have a value, and a sort key. The value must be unique to the custom field. For example, you might have an Incident Type custom field, with options "Data breach", "Performance degradation", "API downtime", etc.

Manage incident severities.

Each incident has a severity, picked from one of the severities configured in your organisations settings.

Severities help categorise incidents, and communicate urgency/impact. You can use severities when filtering incidents in the dashboard, and in workflows and announcement rules.

Manage incident roles.

During an incident, you can assign responders to one of the incident roles that are configured in your organisation settings.

Every organisation will have a special 'lead' role, which signifies the incident lead or commander. This role cannot be deleted, but can be renamed in the incident.io dashboard.

Create and read incidents.

Incidents are a core resource, on which many other resources (actions, etc) are created.

Care should be taken around these endpoints, as automation that creates duplicate incidents can be distracting, and impact reporting.