Create Incident

POST

Creates an incident.

Request

This endpoint expects an object.
titlestringRequiredformat: "text"

Title of the incident.

acknowledged_datestringOptionalformat: "date-time"

Timestamp when the incident was acknowledged.

applies_to_partslist of stringsOptional

Parts to which the incident is applicable to.

artifactslist of stringsOptional

Artifacts attached to the incident.

bodystringOptionalformat: "text"

Body of the incident.

custom_fieldsobjectOptional

Application-defined custom fields.

custom_schema_specobjectOptional

Custom schemas described using identifiers. Each custom field in the request must have the corresponding schema specified; omission results in a Bad Request error. If a custom schema is not included in the specifier, it remains unchanged. For surfaces with human interactors, it is recommended to provide tenant_fragment: true and validate_required_fields: true.

external_source_dataobjectOptional
identified_datestringOptionalformat: "date-time"

Time when the incident was identified/reported.

impactobjectOptional
mitigated_datestringOptionalformat: "date-time"

Timestamp when the incident was mitigated.

owned_bylist of stringsOptional

User IDs of the users that own the incident.

pialist of stringsOptional

The article ids of the Post-Incident Analysis(PIA) of the incident.

playbookslist of stringsOptional

The article ids of the playbook(s) associated with the incident.

related_docslist of stringsOptional

The article ids of other documents associated with the incident.

reported_bylongOptional

The entity that first reported the incident.

severitylongOptional

Severity of the incident.

stageobjectOptional

Create object for stage.

stage_validation_optionslist of enumsOptional
Allowed values: allow_non_start

The type of stage validations options when creating an incident.

staged_infoobjectOptional

Create object for staged_info.

sync_metadataobjectOptional
tagslist of objectsOptional

Tags associated with the object.

target_close_datestringOptionalformat: "date-time"

Timestamp when the incident is expected to be resolved.

sourcelongOptionalDeprecated

Source of where the incident was created. Only sys users and service accounts are supposed to set this field.

Response

Success.

incidentobject
Built with