# create

URL: /business/nouns/incident/create · Id: `verb:Incident.create` · Call: `await $.Incident.create({ … })` (SDK) or the `do` tool at `https://api.sb/mcp`. Inputs says what to pass, Outputs what returns, When it waits who approves.

> Creates an Incident.

Create makes a new [Incident](/business/nouns/incident) from the inputs below. It is inherited: every [Noun](/business/nouns/noun) has `get`, `list`, `create`, `update` and `delete`.

## Inputs
| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `by` | [Worker](/business/nouns/worker) | No | The Worker that performed it. |
| `for` | [Party](/business/nouns/party) | No | The Party it was done on behalf of. |
| `via` | `string` | No | The Interface or request it arrived through. |
| `on` | `string` | No | The Action or Event that caused it, such as the failed attempt a retry follows. |
| `thing` | `string` | No | The record, at the Version the Action was decided against. |
| `input` | `json` | No | The input it was called with. |
| `createdAt` | `datetime` | No | When it was called. |
| `reserved` | `money` | No | The most this Action may cost, held against its Limits from the check until it settles, billed misses included. |
| `due` | `datetime` | No | When the Task is due. |
| `priority` | `integer` | No | Its rank in the inbox, highest first. |
| `recurrence` | `string` | No | The schedule a recurring duty repeats on. |
| `kind` | `string` | No | One of `bug`, `request`, or `question`. |
| `advisory` | `string` | No | For a vulnerability: the public advisory it matches, with the affected package and range. |
| `severity` | `string` | Yes | One of `minor`, `major`, or `critical`. |
| `detectedAt` | `datetime` | Yes | When monitoring or a Customer first reported it. |
| `resolvedAt` | `datetime` | No | When service was restored. |
| `personalData` | `boolean` | No | True when the Incident exposed personal data, which starts the breach-notice clock. |
| `monitor` | [Monitor](/business/nouns/monitor) | No | A failing internal Monitor opens an Incident, which names the Monitor that saw it first. |

## Outputs
| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `incident` | [Incident](/business/nouns/incident) | Yes | The Incident. |

## Effects
- Emits `Incident.created`.
- Two-way: `try`, `send`, `do`.

## Refuses when
| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | [Incident.create](/business/nouns/incident/create) |

## When it waits
| Gate | Default |
| --- | --- |
| Decision class | Low: two-way, nothing at stake |
| [Delay window](/systems/trust-and-governance/controls/one-way-windows) | None: it runs once review passes. |
| Limit | The call [Limit](/business/nouns/limit) of the [Permission](/business/nouns/permission) it runs under. |
| Over the Limit | It waits `pending` for an [Approval](/business/nouns/approval) from the [Founder](/agents/founding/founder). Approved, it runs; refused, it ends `refused` with [`limit-exceeded`](/code/api/errors/limit-exceeded); unanswered by its deadline, it ends `canceled`. |

## Example

**Ask**

```text
Add an incident to TutorLoop.
```

**API**

```bash
curl -X POST https://api.sb/tutorloop.com/incidents \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"severity":"minor","detectedAt":"2026-10-22T12:00:00Z"}'
```

```json
{
  "api": "https://api.sb/tutorloop.com",
  "incident": {
    "$id": "https://api.sb/tutorloop.com/incidents/incident_1",
    "$type": "Incident",
    "status": "pending",
    "mode": "try",
    "severity": "minor",
    "detectedAt": "2026-10-22T12:00:00Z"
  },
  "action": {
    "$id": "https://api.sb/tutorloop.com/actions/action_1",
    "operation": "Incident.create",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/tutorloop.com/actions/action_1"
  }
}
```

**SDK**

```ts
import { $ } from 'startup-builder'

const incident = await $.Incident.create({ severity: 'minor', detectedAt: '2026-10-22T12:00:00Z' })
```

**CLI**

```bash
npx startup-builder do Incident.create --json '{"severity":"minor","detectedAt":"2026-10-22T12:00:00Z"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Incident.create({ severity: 'minor', detectedAt: '2026-10-22T12:00:00Z' })"
  }
}
```