circle-info
Squadcast is now SolarWinds Incident Response

Incidents

Bulk Acknowledge Incidents

post
/v3/incidents/acknowledge
  • This endpoint is used to bulk acknowledge the incident by IDs. The API can handle a maximum of 100 incident IDs in a single request with 10 such calls per minute."

  • Requires access_token as a Bearer {{token}} in the Authorization header.

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Body

Request body for bulk incident operations (acknowledge, resolve).

incident_idsstring[] · max: 100Required
Responses
chevron-right
200

The request has succeeded.

application/json
datastringRequired
post
/v3/incidents/acknowledge

Incident Export

get
/v3/incidents/export
  • This endpoint is used to export the incident details into a csv or json file.

  • Requires access_token as a Bearer {{token}} in the Authorization header.

  • Header field/value: Content-Type: text/csv

Query Params:

type: csv or json
start_time: filter by date range
end_time: filter by date range
services: filter by services
sources: filter by alert sources
assigned_to: filter by assignee
status: filter by incident status
slo_affecting: filetr by slo affected
slos: filter by slos
tags: filter by tags key=value
Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Query parameters
start_timestring · date-timeRequired
end_timestring · date-timeRequired
typestring · enumRequired

Defines the format of the export.

Possible values:
owner_idstringRequired
statusstring[]Optional
servicesstring[]Optional
sourcesstring[]Optional
assigned_tostring[]Optional
assignedToUserIDsAndTheirSquadsstring[]Optional
service_ownerstringOptional
tagsstring[]Optional
slo_affectingstring · enumOptionalPossible values:
slosinteger · int32[]Optional
is_starredstring · enumOptionalPossible values:
textFilterstringOptional
notesstring · enumOptionalPossible values:
retrospectivesstring · enumOptionalPossible values:
sort_bystring · enumOptionalPossible values:
Responses
get
/v3/incidents/export

Incident Export Async

post
/v3/incidents/export/async
  • This is an async API, once the request is made the export will start in our workers. You will get a download link to your registered Email ID once the export is completed

Payload

Key
Value
Example

type

csv / json

“csv”

start_time

Date in ISO Format

“2020-01-01T00:00:00.000Z”

end_time

Date in ISO Format

“2020-04-01T00:00:00.000Z”

owner_id

Team ID

“611262a9d5b4ea846b534a3f”

Incident Filters

Key
Value
Example

statuses

Array of triggered / resolved / acknowledged / suppressed

[“triggered”, “acknowleged”]

tags

Array of tags in format “KEY=VALUE”

[“severity=high”, “severity=low”]

sources

Array of Alert Source IDs

[“6077f7225fdc7075e371685f”]

services

Array of Service IDs

["62385fb309bc474014180828"]

assigned_to

Array of Assigned to user IDs

["625e40c9a9bd76370bf9f7fb"]

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Body

Request body for async incident export.

owner_idstringRequired
typeall ofRequired

Type of export, can be csv or json

string · enumOptional

Defines the format of the export.

Possible values:
start_timestring · date-timeRequired
end_timestring · date-timeRequired
Responses
post
/v3/incidents/export/async

Bulk Incidents Priority Update

put
/v3/incidents/priority
  • This endpoint is used to bulk update incident priority.

  • Requires access_token as a Bearer {{token}} in the Authorization header.

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Body

Request body for bulk updating incident priority.

incident_idsstring[]Required
prioritystringRequired
Responses
put
/v3/incidents/priority

Bulk Resolve Incidents

post
/v3/incidents/resolve
  • This endpoint is used to bulk resolve the incident by IDs. The API can handle a maximum of 100 incident IDs in a single request with 10 such calls per minute."

  • Requires access_token as a Bearer {{token}} in the Authorization header.

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Body

Request body for bulk incident operations (acknowledge, resolve).

incident_idsstring[] · max: 100Required
Responses
chevron-right
200

The request has succeeded.

application/json
datastringRequired
post
/v3/incidents/resolve

Get Incident by ID

get
/v3/incidents/{incidentID}
  • This endpoint is used to get the incident details by ID.

  • Requires access_token as a Bearer {{token}} in the Authorization header.

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Path parameters
incidentIDstringRequired
Responses
chevron-right
200

The request has succeeded.

application/json
get
/v3/incidents/{incidentID}

Acknowledge Incident

post
/v3/incidents/{incidentID}/acknowledge
  • This endpoint is used to acknowledge the incident by ID.

  • Requires access_token as a Bearer {{token}} in the Authorization header.

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Path parameters
incidentIDstringRequired
Responses
chevron-right
200

The request has succeeded.

application/json
datastringRequired
post
/v3/incidents/{incidentID}/acknowledge

Get Incident Events

get
/v3/incidents/{incidentID}/events
  • This endpoint is used to get all the deduped incident events details by either ID or number.

  • Requires access_token as a Bearer {{token}} in the Authorization header.

Query Params:

offset - non zero value
limit - non zero value, maximum is 10
sort - sort it by either asc or desc
deduped - if set to true, it will return only the deduplicated events. if set to false, it will return only the non-deduplicated event, otherwise it will return all the events
Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Path parameters
incidentIDstringRequired
Query parameters
offsetstringRequired

non zero value

limitstringRequired

non zero value, maximum is 10

sortstringRequired

sort it by either asc or desc

dedupedstringRequired

if set to true, it will return only the deduped events.

if set to false, it will return only the non-deduped event.

otherwise it will return all the events

Responses
chevron-right
200

The request has succeeded.

application/json
get
/v3/incidents/{incidentID}/events

Mark Incident SLO False Positive

patch
/v3/incidents/{incidentID}/mark-slo-incident-false-postive/{value}
  • This endpoint is used to mark incident slo false positive.

  • Requires access_token as a Bearer {{token}} in the Authorization header.

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Path parameters
incidentIDstringRequired
valuestringRequired
Responses
chevron-right
200

The request has succeeded.

application/json
objectOptional
patch
/v3/incidents/{incidentID}/mark-slo-incident-false-postive/{value}

Incident Priority Update

patch
/v3/incidents/{incidentID}/priority
  • This endpoint is used to update incident priority by ID.

  • Requires access_token as a Bearer {{token}} in the Authorization header.

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Path parameters
incidentIDstringRequired
Body

Request body for updating incident priority.

prioritystringOptional
Responses
chevron-right
200

The request has succeeded.

application/json
patch
/v3/incidents/{incidentID}/priority

Reassign Incident

post
/v3/incidents/{incidentID}/reassign
  • This endpoint is used to reassign the unresolved incident to any user or escalation policy or squads by ID.

  • Requires access_token as a Bearer {{token}} in the Authorization header.

  • type can be either user or escalationpolicy or squad

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Path parameters
incidentIDstringRequired
Body

Request body for reassigning an incident.

Responses
chevron-right
200

The request has succeeded.

application/json
datastringRequired
post
/v3/incidents/{incidentID}/reassign

Resolve Incident

post
/v3/incidents/{incidentID}/resolve
  • This endpoint is used to resolve the incident by ID.

  • Requires access_token as a Bearer {{token}} in the Authorization header.

  • Resolution Reason is mandatory / optional based on the organization feature settings (Only for Premium and Enterprise Orgs) Read morearrow-up-right

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Path parameters
incidentIDstringRequired
Body

Request body for resolving an incident.

Responses
chevron-right
200

The request has succeeded.

application/json
datastringRequired
post
/v3/incidents/{incidentID}/resolve

Get Incidents Status By RequestIDs

post
/v3/requests/status
  • This endpoint is used to get the status of incidents given list of request_ids

  • Requires access_token as a Bearer {{token}} in the Authorization header.

Response

  • The response contains the mapping from request_ids to incident status.

  • status field can be one of - suppressed, discarded, deduplicated, created, error.

  • status is error if the request_id is invalid. Both incident_id and event_id field won't be present if status is error

  • status is suppressed if the incident was suppressed due to suppression rules.

  • status is deduplicated if the incident was deduplicated due to deduplication rules.

  • status is discarded if the incident was discarded due to some deduplication rule. incident_id field won't be present if status is discarded.

  • otherwise, the status is created

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Body

Request body for getting ingestion status.

request_idsstring[]Required
Responses
chevron-right
200

The request has succeeded.

application/json
requests_statusobjectRequired
post
/v3/requests/status

Last updated