# Incident routes: list, update, delete

URL: /code/api/incident/records-list · Id: `page:code/api/incident/records-list`

> The Incident Verbs list, update, delete as api.sb routes, with inputs, result, refusals and an example.

Reference for [Incident](/business/nouns/incident), one group of [Incident routes](/code/api/incident).

### Incident.list
Returns Incidents, newest first, one page at a time. [Verb page](/business/nouns/incident/list?interface=api).

```text
GET /{namespace}/incidents
```

Query: the inputs. Reads only: it emits no Event.

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `limit` | `integer` | No | At most this many records, up to 100. The default is 20. |
| `after` | `string` | No | The cursor from the previous page. |
| `where` | `string` | No | A filter over the properties, such as `paidAt = null and total.amount > 500`. |
| `sort` | `string` | No | Properties to sort by, comma-separated; a leading minus sorts descending. |
| `total` | `boolean` | No | True adds the match count as `meta.total`, exact up to 10,000 matches and estimated above. |
| `facets` | `string` | No | Properties to count by value, comma-separated, returned as `meta.facets`. |
| `fields` | `string` | No | Properties to return on each record, comma-separated; `$id` and `$type` always return. |
| `include` | `string` | No | Related records to embed in place of their URLs, comma-separated. |
| `depth` | `integer` | No | How many levels of related records to embed. The default is 1. |
| `q` | `string` | No | Words to match across the text properties, ranked by relevance. |
| `match` | `string` | No | Ranks the search by `words`, or `meaning`; words is the default. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `incidents` | list of [Incident](/business/nouns/incident) | Yes | One page of Incidents. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl "https://api.sb/leaseline.app/incidents?limit=20" \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

```json
{
  "api": "https://api.sb/leaseline.app",
  "$type": "Incident",
  "incidents": [
    {
      "$id": "https://api.sb/leaseline.app/incidents/incident_2XOYkIEno0",
      "$type": "Incident",
      "status": "pending",
      "mode": "try",
      "severity": "minor",
      "detectedAt": "2026-10-22T12:00:00Z"
    }
  ],
  "meta": {
    "limit": 20,
    "after": "incident_2XOYkIEno0"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/incidents?limit=20",
    "next": "https://api.sb/leaseline.app/incidents?after=incident_2XOYkIEno0"
  }
}
```

### Incident.update
Changes the given properties of an Incident. [Verb page](/business/nouns/incident/update?interface=api).

```text
PATCH /{namespace}/incidents/{id}
```

Path: `id`. Body, as JSON: the other inputs. Emits `Incident.updated`.

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | `string` | Yes | The id of the Incident. |
| `by` | [Worker](/business/nouns/worker) | No | The Worker that performed it. |
| `for` | [Party](/business/nouns/party) | No | The Party it was done on behalf of. |
| `via` | `string` | No | The Interface or request it arrived through. |
| `on` | `string` | No | The Action or Event that caused it, such as the failed attempt a retry follows. |
| `thing` | `string` | No | The record, at the Version the Action was decided against. |
| `input` | `json` | No | The input it was called with. |
| `createdAt` | `datetime` | No | When it was called. |
| `reserved` | `money` | No | The most this Action may cost, held against its Limits from the check until it settles, billed misses included. |
| `due` | `datetime` | No | When the Task is due. |
| `priority` | `integer` | No | Its rank in the inbox, highest first. |
| `recurrence` | `string` | No | The schedule a recurring duty repeats on. |
| `kind` | `string` | No | One of `bug`, `request`, or `question`. |
| `advisory` | `string` | No | For a vulnerability: the public advisory it matches, with the affected package and range. |
| `severity` | `string` | No | One of `minor`, `major`, or `critical`. |
| `detectedAt` | `datetime` | No | When monitoring or a Customer first reported it. |
| `resolvedAt` | `datetime` | No | When service was restored. |
| `personalData` | `boolean` | No | True when the Incident exposed personal data, which starts the breach-notice clock. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `incident` | [Incident](/business/nouns/incident) | Yes | The Incident. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl -X PATCH https://api.sb/leaseline.app/incidents/incident_2XOYkIEno0 \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"severity":"minor"}'
```

```json
{
  "api": "https://api.sb/leaseline.app",
  "incident": {
    "$id": "https://api.sb/leaseline.app/incidents/incident_2XOYkIEno0",
    "$type": "Incident",
    "status": "pending",
    "mode": "try",
    "severity": "minor",
    "detectedAt": "2026-10-22T12:00:00Z"
  },
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/act_br07HsG8MG",
    "operation": "Incident.update",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/actions/act_br07HsG8MG"
  }
}
```

### Incident.delete
Deletes an Incident: a soft delete that keeps its history, undone by `Thing.restore`. [Verb page](/business/nouns/incident/delete?interface=api).

```text
DELETE /{namespace}/incidents/{id}
```

Path: `id`. Emits `Incident.deleted`.

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | `string` | Yes | The id of the Incident. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `incident` | [Incident](/business/nouns/incident) | Yes | The Incident. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl -X DELETE https://api.sb/leaseline.app/incidents/incident_2XOYkIEno0 \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

```json
{
  "api": "https://api.sb/leaseline.app",
  "incident": {
    "$id": "https://api.sb/leaseline.app/incidents/incident_2XOYkIEno0",
    "$type": "Incident",
    "status": "pending",
    "mode": "try",
    "severity": "minor",
    "detectedAt": "2026-10-22T12:00:00Z"
  },
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/act_br07HsG8MG",
    "operation": "Incident.delete",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/actions/act_br07HsG8MG"
  }
}
```