Skip to content

Incident

An Incident is an Issue where an Interface or Site fails Customers in production, tracked from detection to postmortem.

Properties

PropertyTypeRequiredDescription
severitystringrequiredOne of minor, major, or critical.
detectedAtdatetimerequiredWhen monitoring or a Customer first reported it.
resolvedAtdatetimeWhen service was restored.
personalDatabooleanTrue when the Incident exposed personal data, which starts the breach-notice clock.
Inherited from Issue: 2 properties
PropertyTypeRequiredDescription
kindstringOne of bug, request, or question.
advisorystringFor a vulnerability: the public advisory it matches, with the affected package and range.
Inherited from Task: 3 properties
PropertyTypeRequiredDescription
duedatetimeWhen the Task is due.
priorityintegerIts rank in the inbox, highest first.
recurrencestringThe schedule a recurring duty repeats on.
Inherited from Action: 11 properties
PropertyTypeRequiredDescription
statusstringrequiredOne of pending, done, failed, canceled, or refused.
reasonstringWhy a pending Action waits: queued, running, retrying, awaitingWorker, awaitingInput, awaitingSource, awaitingAction, or awaitingTime.
modestringrequiredHow the caller invoked it: try, send, or do.
byWorkerThe Worker that performed it.
forPartyThe Party it was done on behalf of.
viastringThe Interface or request it arrived through.
onstringThe Action or Event that caused it, such as the failed attempt a retry follows.
thingstringThe record, at the Version the Action was decided against.
inputjsonThe input it was called with.
createdAtdatetimeWhen it was called.
reservedmoneyThe most this Action may cost, held against its Limits from the check until it settles, billed misses included.

Object

JSON
{
  "$id": "https://api.sb/quietcopy.com/incidents/incident_1",
  "$type": "Incident",
  "status": "pending",
  "reason": "queued",
  "mode": "try",
  "by": "worker_1",
  "for": "party_1",
  "via": "API",
  "on": "Invoice.overdue",
  "thing": "invoice_1@v3",
  "input": {},
  "createdAt": "2026-10-22T12:00:00Z",
  "reserved": {
    "amount": 39,
    "currency": "USD"
  },
  "due": "2026-10-22T12:00:00Z",
  "priority": 1,
  "recurrence": "Weekly on Friday",
  "kind": "bug",
  "advisory": "GHSA-xxxx-xxxx-xxxx",
  "severity": "minor",
  "detectedAt": "2026-10-22T12:00:00Z",
  "resolvedAt": "2026-10-22T12:00:00Z",
  "personalData": true
}

Relationships

  • An Incident has one Monitor: a failing internal Monitor opens an Incident, which names the Monitor that saw it first. monitor, inverse opens.

Verbs

  1. createCreates an Incident.
    POST /{namespace}/incidentsdoIncident.created
  2. getReturns one Incident by id.
    GET /{namespace}/incidents/{id}readNo Event
  3. listReturns Incidents, newest first, one page at a time.
    GET /{namespace}/incidentsreadNo Event
  4. updateChanges the given properties of an Incident.
    PATCH /{namespace}/incidents/{id}doIncident.updated
  5. deleteDeletes an Incident; its history is kept.
    DELETE /{namespace}/incidents/{id}doIncident.deleted
  6. acknowledgeAcknowledge records that an on-call Worker owns an open Incident and stops its escalation.
    POST /{namespace}/incidents/{incident}/acknowledgedoIncident.acknowledged
  7. openOpen starts an Incident from a failing Monitor, an error spike or a Metric past its threshold, and pages the on-call Worker.
    POST /{namespace}/incidents/opendoIncident.opened
  8. resolveResolve closes an Incident once its Monitors pass, posts the resolution to the status page and opens the review Task.
    POST /{namespace}/incidents/{incident}/resolvedoIncident.resolved

Permissions

Which Access level may call each Verb. One-way Verbs wait their delay window.

Operationowneradminmemberviewer
Incident.createYesYesYesNo
Incident.getYesYesYesYes
Incident.listYesYesYesYes
Incident.updateYesYesYesNo
Incident.deleteYesYesYesNo
Incident.acknowledgeYesYesYesNo
Incident.openYesYesYesNo
Incident.resolveYesYesYesNo

Call it

Text
Open the latest incident.

Example

Sign-in to a meal-planning App fails for 9 minutes after a deploy. A major Incident opens at detection, the Change reverts, and the postmortem links the fix that prevents a repeat.