Incident
An Incident is an Issue where an Interface or Site fails Customers in production, tracked from detection to postmortem.
Properties
| Property | Type | Required | Description |
|---|---|---|---|
severity | string | required | One of minor, major, or critical. |
detectedAt | datetime | required | When monitoring or a Customer first reported it. |
resolvedAt | datetime | When service was restored. | |
personalData | boolean | True when the Incident exposed personal data, which starts the breach-notice clock. |
Inherited from Issue: 2 properties
| Property | Type | Required | Description |
|---|---|---|---|
kind | string | One of bug, request, or question. | |
advisory | string | For a vulnerability: the public advisory it matches, with the affected package and range. |
Inherited from Task: 3 properties
| Property | Type | Required | Description |
|---|---|---|---|
due | datetime | When the Task is due. | |
priority | integer | Its rank in the inbox, highest first. | |
recurrence | string | The schedule a recurring duty repeats on. |
Inherited from Action: 11 properties
| Property | Type | Required | Description |
|---|---|---|---|
status | string | required | One of pending, done, failed, canceled, or refused. |
reason | string | Why a pending Action waits: queued, running, retrying, awaitingWorker, awaitingInput, awaitingSource, awaitingAction, or awaitingTime. | |
mode | string | required | How the caller invoked it: try, send, or do. |
by | Worker | The Worker that performed it. | |
for | Party | The Party it was done on behalf of. | |
via | string | The Interface or request it arrived through. | |
on | string | The Action or Event that caused it, such as the failed attempt a retry follows. | |
thing | string | The record, at the Version the Action was decided against. | |
input | json | The input it was called with. | |
createdAt | datetime | When it was called. | |
reserved | money | The most this Action may cost, held against its Limits from the check until it settles, billed misses included. |
Object
{
"$id": "https: //api.sb/ quietcopy.com/ incidents/ incident_1",
"$type": "Incident",
"status": "pending",
"reason": "queued",
"mode": "try",
"by": "worker_1",
"for": "party_1",
"via": "API",
"on": "Invoice.overdue",
"thing": "invoice_1@v3",
"input": {},
"createdAt": "2026-10-22T12: 00: 00Z",
"reserved": {
"amount": 39,
"currency": "USD"
},
"due": "2026-10-22T12: 00: 00Z",
"priority": 1,
"recurrence": "Weekly on Friday",
"kind": "bug",
"advisory": "GHSA-xxxx-xxxx-xxxx",
"severity": "minor",
"detectedAt": "2026-10-22T12: 00: 00Z",
"resolvedAt": "2026-10-22T12: 00: 00Z",
"personalData": true
}Relationships
- An Incident has one Monitor: a failing internal Monitor opens an Incident, which names the Monitor that saw it first.
monitor, inverseopens.
Verbs
createCreates an Incident.POST /{namespace}/incidentsgetReturns one Incident by id.GET /{namespace}/incidents/{id}listReturns Incidents, newest first, one page at a time.GET /{namespace}/incidentsupdateChanges the given properties of an Incident.PATCH /{namespace}/incidents/{id}deleteDeletes an Incident; its history is kept.DELETE /{namespace}/incidents/{id}acknowledgeAcknowledge records that an on-call Worker owns an open Incident and stops its escalation.POST /{namespace}/incidents/{incident}/acknowledgeopenOpen starts an Incident from a failing Monitor, an error spike or a Metric past its threshold, and pages the on-call Worker.POST /{namespace}/incidents/openresolveResolve closes an Incident once its Monitors pass, posts the resolution to the status page and opens the review Task.POST /{namespace}/incidents/{incident}/resolve
Permissions
Which Access level may call each Verb. One-way Verbs wait their delay window.
| Operation | owner | admin | member | viewer |
|---|---|---|---|---|
Incident.create | Yes | Yes | Yes | No |
Incident.get | Yes | Yes | Yes | Yes |
Incident.list | Yes | Yes | Yes | Yes |
Incident.update | Yes | Yes | Yes | No |
Incident.delete | Yes | Yes | Yes | No |
Incident.acknowledge | Yes | Yes | Yes | No |
Incident.open | Yes | Yes | Yes | No |
Incident.resolve | Yes | Yes | Yes | No |
Call it
Open the latest incident.Example
Sign-in to a meal-planning App fails for 9 minutes after a deploy. A major Incident opens at detection, the Change reverts, and the postmortem links the fix that prevents a repeat.