Depot incidents

View as Markdown Open in ChatGPT Open in Claude

Registers the incident routes on the TENANT mux.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

POST `/api/v1/alerts/{alertId}/promote`

POSTincident:managetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

promoteAlertToIncident declares an incident from an alert and links the two.

It lives on the ALERT’s URL because that is where an operator is standing when they decide a condition is customer-facing, and the body is the ordinary incident create body: the alert fills only what was left empty.

Parameters

Name	In	Type	Required	Description
`alertId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`components`required	`array of IncidentImpactRequest`
`components[].componentId`required	`string`
`components[].impact`required	`string`
`initialUpdate`	`string or null`
`initialUpdateIsPublic`	`boolean or null`
`internalNotes`	`string or null`
`isPublic`	`boolean or null`
`publicSummary`	`string or null`
`roles`required	`array of IncidentRoleRequest`
`roles[].role`required	`string`
`roles[].userId`required	`string`
`severity`	`string or null`
`startedAt`	`string (date-time) or null`
`templateId`	`string or null`
`templateVars`	`IncidentTemplateVarsDTO`	incidentTemplateVarsDTO is the closed render context.
`templateVars.clientName`required	`string`
`templateVars.components`required	`string`
`templateVars.severity`required	`string`
`templateVars.startedAt`required	`string`
`templateVars.status`required	`string`
`templateVars.title`required	`string`
`title`	`string or null`

Responses

Status	Body	Description
`201`	`application/json`, IncidentView	Created.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	The request conflicts with the current state.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

201 response body

Field	Type	Description
`acknowledgedAt`	`string (date-time) or null`
`createdAt`required	`string (date-time)`
`createdBy`	`string`
`deletedAt`	`string (date-time) or null`
`internalNotes`	`string`
`isPublic`required	`boolean`
`postmortemBody`	`string`
`postmortemPublishedAt`	`string (date-time) or null`
`publicId`required	`string`
`publicSummary`	`string`
`resolvedAt`	`string (date-time) or null`
`severity`required	`string`
`startedAt`required	`string (date-time)`
`status`required	`string`
`title`required	`string`
`updatedAt`required	`string (date-time)`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/alerts/<alertId>/promote' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/alerts/<alertId>/promote' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/alerts/<alertId>/promote"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "components": [
        {
            "componentId": "string",
            "impact": "string",
        },
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": False,
    "internalNotes": "string",
    "isPublic": False,
    "publicSummary": "string",
    "roles": [
        {
            "role": "string",
            "userId": "string",
        },
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
        "clientName": "string",
        "components": "string",
        "severity": "string",
        "startedAt": "string",
        "status": "string",
        "title": "string",
    },
    "title": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/alerts/<alertId>/promote", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/alerts/<alertId>/promote";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "components": [
      {
        "componentId": "string",
        "impact": "string"
      }
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": false,
    "internalNotes": "string",
    "isPublic": false,
    "publicSummary": "string",
    "roles": [
      {
        "role": "string",
        "userId": "string"
      }
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
      "clientName": "string",
      "components": "string",
      "severity": "string",
      "startedAt": "string",
      "status": "string",
      "title": "string"
    },
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/alerts/<alertId>/promote");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/incidents`

GETincident:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listIncidents pages the console’s list.

IncludeDeleted IS NEVER SET FROM THE QUERY STRING. The filter field exists so a purge report or a support tool can ask, and the console cannot: a retired incident that could be listed by adding one parameter would be back on the screen the moment somebody copied a URL, and “we took that off the page” would stop being true.

Parameters

Name	In	Type	Required	Description
`componentId`	query	string	No
`dir`	query	string, one of asc, desc	No	Sort direction.
`openOnly`	query	string	No
`page`	query	integer	No	One-based page number. Defaults to 1.
`pageSize`	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
`publicOnly`	query	string	No
`q`	query	string	No	Free-text search term.
`sort`	query	string, one of created, severity, started, title, updated	No	Sort key.

Responses

Status	Body	Description
`200`	`application/json`, PagedResultIncidentView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:read.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`items`required	`array of IncidentView`
`items[].acknowledgedAt`	`string (date-time) or null`
`items[].createdAt`required	`string (date-time)`
`items[].createdBy`	`string`
`items[].deletedAt`	`string (date-time) or null`
`items[].internalNotes`	`string`
`items[].isPublic`required	`boolean`
`items[].postmortemBody`	`string`
`items[].postmortemPublishedAt`	`string (date-time) or null`
`items[].publicId`required	`string`
`items[].publicSummary`	`string`
`items[].resolvedAt`	`string (date-time) or null`
`items[].severity`required	`string`
`items[].startedAt`required	`string (date-time)`
`items[].status`required	`string`
`items[].title`required	`string`
`items[].updatedAt`required	`string (date-time)`
`page`required	`integer`
`pageSize`required	`integer`
`total`required	`integer`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/incidents?componentId=<componentId>&dir=asc&openOnly=<openOnly>&page=0&pageSize=0&publicOnly=<publicOnly>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/incidents?componentId=<componentId>&dir=asc&openOnly=<openOnly>&page=0&pageSize=0&publicOnly=<publicOnly>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents"
params = {
    "componentId": "<componentId>",
    "dir": "asc",
    "openOnly": "<openOnly>",
    "page": "0",
    "pageSize": "0",
    "publicOnly": "<publicOnly>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents?componentId=<componentId>&dir=asc&openOnly=<openOnly>&page=0&pageSize=0&publicOnly=<publicOnly>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/incidents");
url.searchParams.set("componentId", "<componentId>");
url.searchParams.set("dir", "asc");
url.searchParams.set("openOnly", "<openOnly>");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");
url.searchParams.set("publicOnly", "<publicOnly>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents?componentId=<componentId>&dir=asc&openOnly=<openOnly>&page=0&pageSize=0&publicOnly=<publicOnly>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/incidents`

POSTincident:managetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Create incident

Request body

Required, sent as application/json.

Field	Type	Description
`components`required	`array of IncidentImpactRequest`
`components[].componentId`required	`string`
`components[].impact`required	`string`
`initialUpdate`	`string or null`
`initialUpdateIsPublic`	`boolean or null`
`internalNotes`	`string or null`
`isPublic`	`boolean or null`
`publicSummary`	`string or null`
`roles`required	`array of IncidentRoleRequest`
`roles[].role`required	`string`
`roles[].userId`required	`string`
`severity`	`string or null`
`startedAt`	`string (date-time) or null`
`templateId`	`string or null`
`templateVars`	`IncidentTemplateVarsDTO`	incidentTemplateVarsDTO is the closed render context.
`templateVars.clientName`required	`string`
`templateVars.components`required	`string`
`templateVars.severity`required	`string`
`templateVars.startedAt`required	`string`
`templateVars.status`required	`string`
`templateVars.title`required	`string`
`title`	`string or null`

Responses

Status	Body	Description
`201`	`application/json`, IncidentView	Created.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches.
`409`	`application/problem+json`, ProblemDetails	The request conflicts with the current state.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

201 response body

Field	Type	Description
`acknowledgedAt`	`string (date-time) or null`
`createdAt`required	`string (date-time)`
`createdBy`	`string`
`deletedAt`	`string (date-time) or null`
`internalNotes`	`string`
`isPublic`required	`boolean`
`postmortemBody`	`string`
`postmortemPublishedAt`	`string (date-time) or null`
`publicId`required	`string`
`publicSummary`	`string`
`resolvedAt`	`string (date-time) or null`
`severity`required	`string`
`startedAt`required	`string (date-time)`
`status`required	`string`
`title`required	`string`
`updatedAt`required	`string (date-time)`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/incidents' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/incidents' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/incidents"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "components": [
        {
            "componentId": "string",
            "impact": "string",
        },
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": False,
    "internalNotes": "string",
    "isPublic": False,
    "publicSummary": "string",
    "roles": [
        {
            "role": "string",
            "userId": "string",
        },
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
        "clientName": "string",
        "components": "string",
        "severity": "string",
        "startedAt": "string",
        "status": "string",
        "title": "string",
    },
    "title": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/incidents", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "components": [
      {
        "componentId": "string",
        "impact": "string"
      }
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": false,
    "internalNotes": "string",
    "isPublic": false,
    "publicSummary": "string",
    "roles": [
      {
        "role": "string",
        "userId": "string"
      }
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
      "clientName": "string",
      "components": "string",
      "severity": "string",
      "startedAt": "string",
      "status": "string",
      "title": "string"
    },
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/incidents");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/incidents/{incidentId}`

GETincident:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Get incident

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Responses

Status	Body	Description
`200`	`application/json`, IncidentView	Success.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:read.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`acknowledgedAt`	`string (date-time) or null`
`createdAt`required	`string (date-time)`
`createdBy`	`string`
`deletedAt`	`string (date-time) or null`
`internalNotes`	`string`
`isPublic`required	`boolean`
`postmortemBody`	`string`
`postmortemPublishedAt`	`string (date-time) or null`
`publicId`required	`string`
`publicSummary`	`string`
`resolvedAt`	`string (date-time) or null`
`severity`required	`string`
`startedAt`required	`string (date-time)`
`status`required	`string`
`title`required	`string`
`updatedAt`required	`string (date-time)`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/incidents/<incidentId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents/<incidentId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents/<incidentId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH `/api/v1/incidents/{incidentId}`

PATCHincident:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

patchIncident edits the descriptive half.

It CANNOT move the status; see decision 2 in the file header.

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`components`required	`array of IncidentImpactRequest`
`components[].componentId`required	`string`
`components[].impact`required	`string`
`initialUpdate`	`string or null`
`initialUpdateIsPublic`	`boolean or null`
`internalNotes`	`string or null`
`isPublic`	`boolean or null`
`publicSummary`	`string or null`
`roles`required	`array of IncidentRoleRequest`
`roles[].role`required	`string`
`roles[].userId`required	`string`
`severity`	`string or null`
`startedAt`	`string (date-time) or null`
`templateId`	`string or null`
`templateVars`	`IncidentTemplateVarsDTO`	incidentTemplateVarsDTO is the closed render context.
`templateVars.clientName`required	`string`
`templateVars.components`required	`string`
`templateVars.severity`required	`string`
`templateVars.startedAt`required	`string`
`templateVars.status`required	`string`
`templateVars.title`required	`string`
`title`	`string or null`

Responses

Status	Body	Description
`200`	`application/json`, IncidentView	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	This incident has been deleted.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`acknowledgedAt`	`string (date-time) or null`
`createdAt`required	`string (date-time)`
`createdBy`	`string`
`deletedAt`	`string (date-time) or null`
`internalNotes`	`string`
`isPublic`required	`boolean`
`postmortemBody`	`string`
`postmortemPublishedAt`	`string (date-time) or null`
`publicId`required	`string`
`publicSummary`	`string`
`resolvedAt`	`string (date-time) or null`
`severity`required	`string`
`startedAt`required	`string (date-time)`
`status`required	`string`
`title`required	`string`
`updatedAt`required	`string (date-time)`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PATCH 'https://depot.example.com/api/v1/incidents/<incidentId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "components": [
        {
            "componentId": "string",
            "impact": "string",
        },
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": False,
    "internalNotes": "string",
    "isPublic": False,
    "publicSummary": "string",
    "roles": [
        {
            "role": "string",
            "userId": "string",
        },
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
        "clientName": "string",
        "components": "string",
        "severity": "string",
        "startedAt": "string",
        "status": "string",
        "title": "string",
    },
    "title": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/incidents/<incidentId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "components": [
      {
        "componentId": "string",
        "impact": "string"
      }
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": false,
    "internalNotes": "string",
    "isPublic": false,
    "publicSummary": "string",
    "roles": [
      {
        "role": "string",
        "userId": "string"
      }
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
      "clientName": "string",
      "components": "string",
      "severity": "string",
      "startedAt": "string",
      "status": "string",
      "title": "string"
    },
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/incidents/<incidentId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE `/api/v1/incidents/{incidentId}`

DELETEincident:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

deleteIncident retires one.

A SOFT delete: it comes off the lists and off the page without coming out of the database.

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Responses

Status	Body	Description
`204`	None	Success, with no body.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/incidents/<incidentId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/incidents/<incidentId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/incidents/<incidentId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/incidents/{incidentId}/action-items`

GETincident:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List incident action items

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Responses

Status	Body	Description
`200`	`application/json`, array of IncidentActionItemView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:read.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`[].assigneeName`	`string`
`[].assigneeUserId`	`string`
`[].createdAt`required	`string (date-time)`
`[].dueAt`	`string (date-time) or null`
`[].publicId`required	`string`
`[].status`required	`string`
`[].ticketId`	`string`
`[].title`required	`string`
`[].updatedAt`required	`string (date-time)`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/incidents/<incidentId>/action-items' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/action-items' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/action-items"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents/<incidentId>/action-items", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/action-items";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents/<incidentId>/action-items");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/incidents/{incidentId}/action-items`

POSTincident:managetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Create incident action item

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`assigneeUserId`	`string or null`
`dueAt`	`string (date-time) or null`
`status`	`string or null`
`title`	`string or null`

Responses

Status	Body	Description
`201`	`application/json`, IncidentActionItemView	Created.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	This incident has been deleted.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

201 response body

Field	Type	Description
`assigneeName`	`string`
`assigneeUserId`	`string`
`createdAt`required	`string (date-time)`
`dueAt`	`string (date-time) or null`
`publicId`required	`string`
`status`required	`string`
`ticketId`	`string`
`title`required	`string`
`updatedAt`required	`string (date-time)`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/incidents/<incidentId>/action-items' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "assigneeUserId": "string",
  "dueAt": "2026-01-01T00:00:00Z",
  "status": "string",
  "title": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "assigneeUserId": "string",
  "dueAt": "2026-01-01T00:00:00Z",
  "status": "string",
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/action-items' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/action-items"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "assigneeUserId": "string",
    "dueAt": "2026-01-01T00:00:00Z",
    "status": "string",
    "title": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "assigneeUserId": "string",
  "dueAt": "2026-01-01T00:00:00Z",
  "status": "string",
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/incidents/<incidentId>/action-items", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/action-items";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "assigneeUserId": "string",
    "dueAt": "2026-01-01T00:00:00Z",
    "status": "string",
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "assigneeUserId": "string",
  "dueAt": "2026-01-01T00:00:00Z",
  "status": "string",
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/incidents/<incidentId>/action-items");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH `/api/v1/incidents/{incidentId}/action-items/{itemId}`

PATCHincident:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Update incident action item

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.
`itemId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`assigneeUserId`	`string or null`
`dueAt`	`string (date-time) or null`
`status`	`string or null`
`title`	`string or null`

Responses

Status	Body	Description
`200`	`application/json`, IncidentActionItemView	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	This incident has been deleted.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

200 response body

Field	Type	Description
`assigneeName`	`string`
`assigneeUserId`	`string`
`createdAt`required	`string (date-time)`
`dueAt`	`string (date-time) or null`
`publicId`required	`string`
`status`required	`string`
`ticketId`	`string`
`title`required	`string`
`updatedAt`required	`string (date-time)`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PATCH 'https://depot.example.com/api/v1/incidents/<incidentId>/action-items/<itemId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "assigneeUserId": "string",
  "dueAt": "2026-01-01T00:00:00Z",
  "status": "string",
  "title": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "assigneeUserId": "string",
  "dueAt": "2026-01-01T00:00:00Z",
  "status": "string",
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/action-items/<itemId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/action-items/<itemId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "assigneeUserId": "string",
    "dueAt": "2026-01-01T00:00:00Z",
    "status": "string",
    "title": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "assigneeUserId": "string",
  "dueAt": "2026-01-01T00:00:00Z",
  "status": "string",
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/incidents/<incidentId>/action-items/<itemId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/action-items/<itemId>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "assigneeUserId": "string",
    "dueAt": "2026-01-01T00:00:00Z",
    "status": "string",
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "assigneeUserId": "string",
  "dueAt": "2026-01-01T00:00:00Z",
  "status": "string",
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/incidents/<incidentId>/action-items/<itemId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/incidents/{incidentId}/action-items/{itemId}/ticket`

POSTincident:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

spawnActionItemTicket opens an ORDINARY ticket for the item and links all three rows.

An item that already has a ticket is returned unchanged rather than given a second one: the console offers this from two places, and two tickets for one agreed fix is how remediation ends up half-done in each.

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.
`itemId`	path	string	Yes	A uuid.

Responses

Status	Body	Description
`200`	`application/json`, IncidentActionItemView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	This incident has been deleted.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

200 response body

Field	Type	Description
`assigneeName`	`string`
`assigneeUserId`	`string`
`createdAt`required	`string (date-time)`
`dueAt`	`string (date-time) or null`
`publicId`required	`string`
`status`required	`string`
`ticketId`	`string`
`title`required	`string`
`updatedAt`required	`string (date-time)`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/incidents/<incidentId>/action-items/<itemId>/ticket' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/action-items/<itemId>/ticket' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/action-items/<itemId>/ticket"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/incidents/<incidentId>/action-items/<itemId>/ticket", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/action-items/<itemId>/ticket";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/incidents/<incidentId>/action-items/<itemId>/ticket");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/incidents/{incidentId}/alerts`

GETincident:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List incident alert links

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Responses

Status	Body	Description
`200`	`application/json`, array of IncidentAlertLinkView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:read.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`[].alertId`required	`string`
`[].alertTitle`	`string`
`[].linkedAt`required	`string (date-time)`
`[].linkedBy`	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/incidents/<incidentId>/alerts' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/alerts' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/alerts"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents/<incidentId>/alerts", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/alerts";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents/<incidentId>/alerts");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/incidents/{incidentId}/alerts`

POSTincident:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Link incident alert

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`alertId`	`string or null`
`kind`	`string or null`
`ticketId`	`string or null`

Responses

Status	Body	Description
`204`	None	Success, with no body.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	This incident has been deleted.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/incidents/<incidentId>/alerts' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "alertId": "string",
  "kind": "string",
  "ticketId": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "alertId": "string",
  "kind": "string",
  "ticketId": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/alerts' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/alerts"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "alertId": "string",
    "kind": "string",
    "ticketId": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "alertId": "string",
  "kind": "string",
  "ticketId": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/incidents/<incidentId>/alerts", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/alerts";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "alertId": "string",
    "kind": "string",
    "ticketId": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "alertId": "string",
  "kind": "string",
  "ticketId": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/incidents/<incidentId>/alerts");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE `/api/v1/incidents/{incidentId}/alerts/{alertId}`

DELETEincident:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Unlink incident alert

Parameters

Name	In	Type	Required	Description
`alertId`	path	string	Yes	A uuid.
`incidentId`	path	string	Yes	A uuid.

Responses

Status	Body	Description
`204`	None	Success, with no body.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	This incident has been deleted.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/incidents/<incidentId>/alerts/<alertId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/alerts/<alertId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/alerts/<alertId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/incidents/<incidentId>/alerts/<alertId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/alerts/<alertId>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/incidents/<incidentId>/alerts/<alertId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/incidents/{incidentId}/components`

GETincident:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List incident impacts

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Responses

Status	Body	Description
`200`	`application/json`, array of IncidentImpactView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:read.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`[].componentId`required	`string`
`[].componentName`	`string`
`[].endedAt`	`string (date-time) or null`
`[].impact`required	`string`
`[].startedAt`required	`string (date-time)`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/incidents/<incidentId>/components' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/components' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/components"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents/<incidentId>/components", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/components";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents/<incidentId>/components");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT `/api/v1/incidents/{incidentId}/components`

PUTincident:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

replaceIncidentImpacts sets the whole set.

A PUT and not a POST because the body is the complete list: the console renders checkboxes, and the store preserves each surviving component’s StartedAt so re-saving an unchanged list does not restart an outage clock.

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`components`required	`array of IncidentImpactRequest`
`components[].componentId`required	`string`
`components[].impact`required	`string`
`initialUpdate`	`string or null`
`initialUpdateIsPublic`	`boolean or null`
`internalNotes`	`string or null`
`isPublic`	`boolean or null`
`publicSummary`	`string or null`
`roles`required	`array of IncidentRoleRequest`
`roles[].role`required	`string`
`roles[].userId`required	`string`
`severity`	`string or null`
`startedAt`	`string (date-time) or null`
`templateId`	`string or null`
`templateVars`	`IncidentTemplateVarsDTO`	incidentTemplateVarsDTO is the closed render context.
`templateVars.clientName`required	`string`
`templateVars.components`required	`string`
`templateVars.severity`required	`string`
`templateVars.startedAt`required	`string`
`templateVars.status`required	`string`
`templateVars.title`required	`string`
`title`	`string or null`

Responses

Status	Body	Description
`200`	`application/json`, array of IncidentImpactView	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	This incident has been deleted.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

200 response body

Field	Type	Description
`[].componentId`required	`string`
`[].componentName`	`string`
`[].endedAt`	`string (date-time) or null`
`[].impact`required	`string`
`[].startedAt`required	`string (date-time)`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/incidents/<incidentId>/components' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/components' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/components"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "components": [
        {
            "componentId": "string",
            "impact": "string",
        },
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": False,
    "internalNotes": "string",
    "isPublic": False,
    "publicSummary": "string",
    "roles": [
        {
            "role": "string",
            "userId": "string",
        },
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
        "clientName": "string",
        "components": "string",
        "severity": "string",
        "startedAt": "string",
        "status": "string",
        "title": "string",
    },
    "title": "string",
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/incidents/<incidentId>/components", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/components";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "components": [
      {
        "componentId": "string",
        "impact": "string"
      }
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": false,
    "internalNotes": "string",
    "isPublic": false,
    "publicSummary": "string",
    "roles": [
      {
        "role": "string",
        "userId": "string"
      }
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
      "clientName": "string",
      "components": "string",
      "severity": "string",
      "startedAt": "string",
      "status": "string",
      "title": "string"
    },
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/incidents/<incidentId>/components");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT `/api/v1/incidents/{incidentId}/postmortem`

PUTincident:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

publishPostmortem writes the analysis and moves the incident into ‘postmortem’, which is the only way into that status and is reachable only from ‘resolved’.

An incident cannot be analysed before it has ended.

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`body`	`string or null`

Responses

Status	Body	Description
`200`	`application/json`, IncidentView	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	This incident has been deleted.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

200 response body

Field	Type	Description
`acknowledgedAt`	`string (date-time) or null`
`createdAt`required	`string (date-time)`
`createdBy`	`string`
`deletedAt`	`string (date-time) or null`
`internalNotes`	`string`
`isPublic`required	`boolean`
`postmortemBody`	`string`
`postmortemPublishedAt`	`string (date-time) or null`
`publicId`required	`string`
`publicSummary`	`string`
`resolvedAt`	`string (date-time) or null`
`severity`required	`string`
`startedAt`required	`string (date-time)`
`status`required	`string`
`title`required	`string`
`updatedAt`required	`string (date-time)`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/incidents/<incidentId>/postmortem' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "body": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "body": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/postmortem' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/postmortem"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "body": "string",
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "body": "string"
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/incidents/<incidentId>/postmortem", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/postmortem";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "body": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "body": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/incidents/<incidentId>/postmortem");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/incidents/{incidentId}/roles`

GETincident:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List incident roles

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Responses

Status	Body	Description
`200`	`application/json`, array of IncidentRoleView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:read.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`[].assignedAt`required	`string (date-time)`
`[].role`required	`string`
`[].userId`required	`string`
`[].userName`	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/incidents/<incidentId>/roles' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/roles' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/roles"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents/<incidentId>/roles", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/roles";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents/<incidentId>/roles");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT `/api/v1/incidents/{incidentId}/roles`

PUTincident:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

replaceIncidentRoles writes the whole set in one transaction, which is what makes a commander handover a swap rather than a moment with two.

A body naming two commanders answers 409 from the partial unique index, not a half-applied set.

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`components`required	`array of IncidentImpactRequest`
`components[].componentId`required	`string`
`components[].impact`required	`string`
`initialUpdate`	`string or null`
`initialUpdateIsPublic`	`boolean or null`
`internalNotes`	`string or null`
`isPublic`	`boolean or null`
`publicSummary`	`string or null`
`roles`required	`array of IncidentRoleRequest`
`roles[].role`required	`string`
`roles[].userId`required	`string`
`severity`	`string or null`
`startedAt`	`string (date-time) or null`
`templateId`	`string or null`
`templateVars`	`IncidentTemplateVarsDTO`	incidentTemplateVarsDTO is the closed render context.
`templateVars.clientName`required	`string`
`templateVars.components`required	`string`
`templateVars.severity`required	`string`
`templateVars.startedAt`required	`string`
`templateVars.status`required	`string`
`templateVars.title`required	`string`
`title`	`string or null`

Responses

Status	Body	Description
`200`	`application/json`, array of IncidentRoleView	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	This incident has been deleted.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

200 response body

Field	Type	Description
`[].assignedAt`required	`string (date-time)`
`[].role`required	`string`
`[].userId`required	`string`
`[].userName`	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/incidents/<incidentId>/roles' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/roles' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/roles"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "components": [
        {
            "componentId": "string",
            "impact": "string",
        },
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": False,
    "internalNotes": "string",
    "isPublic": False,
    "publicSummary": "string",
    "roles": [
        {
            "role": "string",
            "userId": "string",
        },
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
        "clientName": "string",
        "components": "string",
        "severity": "string",
        "startedAt": "string",
        "status": "string",
        "title": "string",
    },
    "title": "string",
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/incidents/<incidentId>/roles", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/roles";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "components": [
      {
        "componentId": "string",
        "impact": "string"
      }
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": false,
    "internalNotes": "string",
    "isPublic": false,
    "publicSummary": "string",
    "roles": [
      {
        "role": "string",
        "userId": "string"
      }
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
      "clientName": "string",
      "components": "string",
      "severity": "string",
      "startedAt": "string",
      "status": "string",
      "title": "string"
    },
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/incidents/<incidentId>/roles");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/incidents/{incidentId}/tickets`

GETincident:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List incident ticket links

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Responses

Status	Body	Description
`200`	`application/json`, array of IncidentTicketLinkView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:read.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`[].kind`required	`string, one of action_item, attached, change, problem`
`[].linkedAt`required	`string (date-time)`
`[].linkedBy`	`string`
`[].ticketId`required	`string`
`[].ticketReference`	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/incidents/<incidentId>/tickets' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/tickets' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/tickets"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents/<incidentId>/tickets", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/tickets";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents/<incidentId>/tickets");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/incidents/{incidentId}/tickets`

POSTincident:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Link incident ticket

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`alertId`	`string or null`
`kind`	`string or null`
`ticketId`	`string or null`

Responses

Status	Body	Description
`204`	None	Success, with no body.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	This incident has been deleted.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/incidents/<incidentId>/tickets' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "alertId": "string",
  "kind": "string",
  "ticketId": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "alertId": "string",
  "kind": "string",
  "ticketId": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/tickets' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/tickets"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "alertId": "string",
    "kind": "string",
    "ticketId": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "alertId": "string",
  "kind": "string",
  "ticketId": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/incidents/<incidentId>/tickets", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/tickets";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "alertId": "string",
    "kind": "string",
    "ticketId": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "alertId": "string",
  "kind": "string",
  "ticketId": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/incidents/<incidentId>/tickets");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE `/api/v1/incidents/{incidentId}/tickets/{ticketId}`

DELETEincident:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Unlink incident ticket

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.
`ticketId`	path	string	Yes	A uuid.

Responses

Status	Body	Description
`204`	None	Success, with no body.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	This incident has been deleted.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/incidents/<incidentId>/tickets/<ticketId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/tickets/<ticketId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/tickets/<ticketId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/incidents/<incidentId>/tickets/<ticketId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/tickets/<ticketId>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/incidents/<incidentId>/tickets/<ticketId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/incidents/{incidentId}/updates`

GETincident:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listIncidentUpdates returns the whole timeline, private entries included.

This is the ADMIN face; the public page’s read is the statuspage package’s and passes includePrivate false.

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.
`page`	query	integer	No	One-based page number. Defaults to 1.
`pageSize`	query	integer	No	Rows per page, 1 to 200. Defaults to 50.

Responses

Status	Body	Description
`200`	`application/json`, PagedResultIncidentUpdateView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:read.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`items`required	`array of IncidentUpdateView`
`items[].body`required	`string`
`items[].createdAt`required	`string (date-time)`
`items[].createdBy`	`string`
`items[].isPublic`required	`boolean`
`items[].publicId`required	`string`
`items[].status`required	`string`
`page`required	`integer`
`pageSize`required	`integer`
`total`required	`integer`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/incidents/<incidentId>/updates?page=0&pageSize=0' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/updates?page=0&pageSize=0' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/updates"
params = {
    "page": "0",
    "pageSize": "0",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents/<incidentId>/updates?page=0&pageSize=0", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/incidents/<incidentId>/updates");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents/<incidentId>/updates?page=0&pageSize=0");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/incidents/{incidentId}/updates`

POSTincident:managetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

appendIncidentUpdate is the ONLY way an incident’s status moves.

The response carries both halves - the entry that was written and the incident as it now stands - because the console needs the second to re-render the header and a follow-up GET would race the next operator’s update.

Parameters

Name	In	Type	Required	Description
`incidentId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`at`	`string (date-time) or null`
`body`	`string or null`
`isPublic`	`boolean or null`
`status`	`string or null`

Responses

Status	Body	Description
`201`	`application/json`, object	Created.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	This incident has been deleted.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/incidents/<incidentId>/updates' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "at": "2026-01-01T00:00:00Z",
  "body": "string",
  "isPublic": false,
  "status": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "at": "2026-01-01T00:00:00Z",
  "body": "string",
  "isPublic": false,
  "status": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/incidents/<incidentId>/updates' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/incidents/<incidentId>/updates"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "at": "2026-01-01T00:00:00Z",
    "body": "string",
    "isPublic": False,
    "status": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "at": "2026-01-01T00:00:00Z",
  "body": "string",
  "isPublic": false,
  "status": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/incidents/<incidentId>/updates", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/<incidentId>/updates";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "at": "2026-01-01T00:00:00Z",
    "body": "string",
    "isPublic": false,
    "status": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "at": "2026-01-01T00:00:00Z",
  "body": "string",
  "isPublic": false,
  "status": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/incidents/<incidentId>/updates");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/incidents/metrics`

GETincident:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Incident metrics

Responses

Status	Body	Description
`200`	`application/json`, IncidentMetricsView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold incident:read.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`byComponent`required	`array of IncidentComponentCountRow`
`byComponent[].componentId`required	`string`
`byComponent[].count`required	`integer`
`byComponent[].name`required	`string`
`byMonth`required	`array of IncidentMonthCountView`
`byMonth[].count`required	`integer`
`byMonth[].month`required	`string`
`bySeverity`required	`object`
`from`required	`string (date-time)`
`mttaSeconds`required	`number`	double.
`mttrSeconds`required	`number`	double.
`to`required	`string (date-time)`
`uptime`required	`array of ComponentUptimeView`
`uptime[].componentId`required	`string`
`uptime[].downSeconds`required	`integer`	int64.
`uptime[].name`required	`string`
`uptime[].uptimePercent`required	`number`	double.

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/incidents/metrics' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/incidents/metrics' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/incidents/metrics"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents/metrics", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/incidents/metrics";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents/metrics");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.

Depot incidents

POST /api/v1/alerts/{alertId}/promote

Parameters

Request body

Responses

Request samples

GET /api/v1/incidents

Parameters

Responses

Request samples

POST /api/v1/incidents

Request body

Responses

Request samples

GET /api/v1/incidents/{incidentId}

Parameters

Responses

Request samples

PATCH /api/v1/incidents/{incidentId}

Parameters

Request body

Responses

Request samples

DELETE /api/v1/incidents/{incidentId}

Parameters

Responses

Request samples

GET /api/v1/incidents/{incidentId}/action-items

Parameters

Responses

Request samples

POST /api/v1/incidents/{incidentId}/action-items

Parameters

Request body

Responses

Request samples

PATCH /api/v1/incidents/{incidentId}/action-items/{itemId}

Parameters

Request body

Responses

Request samples

POST /api/v1/incidents/{incidentId}/action-items/{itemId}/ticket

Parameters

Responses

Request samples

GET /api/v1/incidents/{incidentId}/alerts

Parameters

Responses

Request samples

POST /api/v1/incidents/{incidentId}/alerts

Parameters

Request body

Responses

Request samples

DELETE /api/v1/incidents/{incidentId}/alerts/{alertId}

Parameters

Responses

Request samples

GET /api/v1/incidents/{incidentId}/components

Parameters

Responses

Request samples

PUT /api/v1/incidents/{incidentId}/components

Parameters

Request body

Responses

Request samples

PUT /api/v1/incidents/{incidentId}/postmortem

Parameters

Request body

Responses

Request samples

GET /api/v1/incidents/{incidentId}/roles

Parameters

Responses

Request samples

PUT /api/v1/incidents/{incidentId}/roles

Parameters

Request body

Responses

POST `/api/v1/alerts/{alertId}/promote`

GET `/api/v1/incidents`

POST `/api/v1/incidents`

GET `/api/v1/incidents/{incidentId}`

PATCH `/api/v1/incidents/{incidentId}`

DELETE `/api/v1/incidents/{incidentId}`

GET `/api/v1/incidents/{incidentId}/action-items`

POST `/api/v1/incidents/{incidentId}/action-items`

PATCH `/api/v1/incidents/{incidentId}/action-items/{itemId}`

POST `/api/v1/incidents/{incidentId}/action-items/{itemId}/ticket`

GET `/api/v1/incidents/{incidentId}/alerts`

POST `/api/v1/incidents/{incidentId}/alerts`

DELETE `/api/v1/incidents/{incidentId}/alerts/{alertId}`

GET `/api/v1/incidents/{incidentId}/components`

PUT `/api/v1/incidents/{incidentId}/components`

PUT `/api/v1/incidents/{incidentId}/postmortem`

GET `/api/v1/incidents/{incidentId}/roles`

PUT `/api/v1/incidents/{incidentId}/roles`

GET `/api/v1/incidents/{incidentId}/tickets`

POST `/api/v1/incidents/{incidentId}/tickets`

DELETE `/api/v1/incidents/{incidentId}/tickets/{ticketId}`

GET `/api/v1/incidents/{incidentId}/updates`

POST `/api/v1/incidents/{incidentId}/updates`

GET `/api/v1/incidents/metrics`