--- title: "Depot incidents" description: "Every incidents operation in the Depot API, with parameters, responses and code samples in six languages." url: "https://support.outpostplatform.com/api/generated/depot/incidents/" product: "depot" type: "reference" status: "reviewed" last_reviewed: 2026-11-06 source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/api/generated/depot/incidents.mdx" license: "CC BY 4.0" --- # Depot incidents Registers the incident routes on the TENANT mux. This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to. ### POST `/api/v1/alerts/{alertId}/promote` {#depot.incidents.promoteAlertTo} **promoteAlertToIncident declares an incident from an alert and links the two.** It lives on the ALERT's URL because that is where an operator is standing when they decide a condition is customer-facing, and the body is the ordinary incident create body: the alert fills only what was left empty. #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `alertId` | path | string | Yes | A uuid. | #### Request body Required, sent as `application/json`. #### Responses | Status | Body | Description | | --- | --- | --- | | `201` | `application/json`, IncidentView | Created. | | `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | The request conflicts with the current state. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. curl -X POST 'https://depot.example.com/api/v1/alerts//promote' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -b 'outpost_console=' \ --data '{ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Content-Type' = 'application/json' 'Cookie' = 'outpost_console=' } $body = @' { "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" } '@ $response = Invoke-RestMethod ` -Method Post ` -Uri 'https://depot.example.com/api/v1/alerts//promote' ` -Headers $headers ` -ContentType 'application/json' ` -Body $body $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. import requests url = "https://depot.example.com/api/v1/alerts//promote" headers = { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", } cookies = { "outpost_console": "", } payload = { "components": [ { "componentId": "string", "impact": "string", }, ], "initialUpdate": "string", "initialUpdateIsPublic": False, "internalNotes": "string", "isPublic": False, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string", }, ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string", }, "title": "string", } response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. package main import ( "bytes" "fmt" "io" "log" "net/http" ) func main() { body := []byte(`{ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }`) req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/alerts//promote", bytes.NewReader(body)) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.Header.Set("Content-Type", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/alerts//promote"; const response = await fetch(url, { method: "POST", headers: { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", }, credentials: "include", body: JSON.stringify({ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }), }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. using System; using System.Net.Http; using System.Text; using var client = new HttpClient(); const string body = """ { "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" } """; var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/alerts//promote"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); request.Content = new StringContent(body, Encoding.UTF8, "application/json"); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### GET `/api/v1/incidents` {#depot.incidents.list} **listIncidents pages the console's list.** IncludeDeleted IS NEVER SET FROM THE QUERY STRING. The filter field exists so a purge report or a support tool can ask, and the console cannot: a retired incident that could be listed by adding one parameter would be back on the screen the moment somebody copied a URL, and "we took that off the page" would stop being true. #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `componentId` | query | string | No | | | `dir` | query | string, one of asc, desc | No | Sort direction. | | `openOnly` | query | string | No | | | `page` | query | integer | No | One-based page number. Defaults to 1. | | `pageSize` | query | integer | No | Rows per page, 1 to 200. Defaults to 50. | | `publicOnly` | query | string | No | | | `q` | query | string | No | Free-text search term. | | `sort` | query | string, one of created, severity, started, title, updated | No | Sort key. | #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, PagedResultIncidentView | Success. | | `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:read. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X GET 'https://depot.example.com/api/v1/incidents?componentId=&dir=asc&openOnly=&page=0&pageSize=0&publicOnly=' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Get ` -Uri 'https://depot.example.com/api/v1/incidents?componentId=&dir=asc&openOnly=&page=0&pageSize=0&publicOnly=' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents" params = { "componentId": "", "dir": "asc", "openOnly": "", "page": "0", "pageSize": "0", "publicOnly": "", } headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents?componentId=&dir=asc&openOnly=&page=0&pageSize=0&publicOnly=", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = new URL("https://depot.example.com/api/v1/incidents"); url.searchParams.set("componentId", ""); url.searchParams.set("dir", "asc"); url.searchParams.set("openOnly", ""); url.searchParams.set("page", "0"); url.searchParams.set("pageSize", "0"); url.searchParams.set("publicOnly", ""); const response = await fetch(url, { method: "GET", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents?componentId=&dir=asc&openOnly=&page=0&pageSize=0&publicOnly="); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### POST `/api/v1/incidents` {#depot.incidents.create} **Create incident** #### Request body Required, sent as `application/json`. #### Responses | Status | Body | Description | | --- | --- | --- | | `201` | `application/json`, IncidentView | Created. | | `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches. | | `409` | `application/problem+json`, ProblemDetails | The request conflicts with the current state. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. curl -X POST 'https://depot.example.com/api/v1/incidents' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -b 'outpost_console=' \ --data '{ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Content-Type' = 'application/json' 'Cookie' = 'outpost_console=' } $body = @' { "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" } '@ $response = Invoke-RestMethod ` -Method Post ` -Uri 'https://depot.example.com/api/v1/incidents' ` -Headers $headers ` -ContentType 'application/json' ` -Body $body $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. import requests url = "https://depot.example.com/api/v1/incidents" headers = { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", } cookies = { "outpost_console": "", } payload = { "components": [ { "componentId": "string", "impact": "string", }, ], "initialUpdate": "string", "initialUpdateIsPublic": False, "internalNotes": "string", "isPublic": False, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string", }, ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string", }, "title": "string", } response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. package main import ( "bytes" "fmt" "io" "log" "net/http" ) func main() { body := []byte(`{ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }`) req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/incidents", bytes.NewReader(body)) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.Header.Set("Content-Type", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents"; const response = await fetch(url, { method: "POST", headers: { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", }, credentials: "include", body: JSON.stringify({ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }), }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. using System; using System.Net.Http; using System.Text; using var client = new HttpClient(); const string body = """ { "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" } """; var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/incidents"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); request.Content = new StringContent(body, Encoding.UTF8, "application/json"); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### GET `/api/v1/incidents/{incidentId}` {#depot.incidents.get} **Get incident** #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, IncidentView | Success. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:read. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X GET 'https://depot.example.com/api/v1/incidents/' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Get ` -Uri 'https://depot.example.com/api/v1/incidents/' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents/" headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.get(url, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents/", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents/"; const response = await fetch(url, { method: "GET", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents/"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### PATCH `/api/v1/incidents/{incidentId}` {#depot.incidents.patch} **patchIncident edits the descriptive half.** It CANNOT move the status; see decision 2 in the file header. #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Request body Required, sent as `application/json`. #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, IncidentView | Success. | | `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | This incident has been deleted. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X PATCH 'https://depot.example.com/api/v1/incidents/' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -b 'outpost_console=' \ --data '{ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Content-Type' = 'application/json' 'Cookie' = 'outpost_console=' } $body = @' { "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" } '@ $response = Invoke-RestMethod ` -Method Patch ` -Uri 'https://depot.example.com/api/v1/incidents/' ` -Headers $headers ` -ContentType 'application/json' ` -Body $body $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents/" headers = { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", } cookies = { "outpost_console": "", } payload = { "components": [ { "componentId": "string", "impact": "string", }, ], "initialUpdate": "string", "initialUpdateIsPublic": False, "internalNotes": "string", "isPublic": False, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string", }, ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string", }, "title": "string", } response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "bytes" "fmt" "io" "log" "net/http" ) func main() { body := []byte(`{ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }`) req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/incidents/", bytes.NewReader(body)) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.Header.Set("Content-Type", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents/"; const response = await fetch(url, { method: "PATCH", headers: { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", }, credentials: "include", body: JSON.stringify({ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }), }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using System.Text; using var client = new HttpClient(); const string body = """ { "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" } """; var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/incidents/"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); request.Content = new StringContent(body, Encoding.UTF8, "application/json"); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### DELETE `/api/v1/incidents/{incidentId}` {#depot.incidents.delete} **deleteIncident retires one.** A SOFT delete: it comes off the lists and off the page without coming out of the database. #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Responses | Status | Body | Description | | --- | --- | --- | | `204` | None | Success, with no body. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X DELETE 'https://depot.example.com/api/v1/incidents/' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Delete ` -Uri 'https://depot.example.com/api/v1/incidents/' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents/" headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.delete(url, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/incidents/", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents/"; const response = await fetch(url, { method: "DELETE", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/incidents/"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### GET `/api/v1/incidents/{incidentId}/action-items` {#depot.incidents.listActionItems} **List incident action items** #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, array of IncidentActionItemView | Success. | | `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:read. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X GET 'https://depot.example.com/api/v1/incidents//action-items' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Get ` -Uri 'https://depot.example.com/api/v1/incidents//action-items' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//action-items" headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.get(url, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents//action-items", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//action-items"; const response = await fetch(url, { method: "GET", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents//action-items"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### POST `/api/v1/incidents/{incidentId}/action-items` {#depot.incidents.createActionItem} **Create incident action item** #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Request body Required, sent as `application/json`. #### Responses | Status | Body | Description | | --- | --- | --- | | `201` | `application/json`, IncidentActionItemView | Created. | | `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | This incident has been deleted. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. curl -X POST 'https://depot.example.com/api/v1/incidents//action-items' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -b 'outpost_console=' \ --data '{ "assigneeUserId": "string", "dueAt": "2026-01-01T00:00:00Z", "status": "string", "title": "string" }' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Content-Type' = 'application/json' 'Cookie' = 'outpost_console=' } $body = @' { "assigneeUserId": "string", "dueAt": "2026-01-01T00:00:00Z", "status": "string", "title": "string" } '@ $response = Invoke-RestMethod ` -Method Post ` -Uri 'https://depot.example.com/api/v1/incidents//action-items' ` -Headers $headers ` -ContentType 'application/json' ` -Body $body $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. import requests url = "https://depot.example.com/api/v1/incidents//action-items" headers = { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", } cookies = { "outpost_console": "", } payload = { "assigneeUserId": "string", "dueAt": "2026-01-01T00:00:00Z", "status": "string", "title": "string", } response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. package main import ( "bytes" "fmt" "io" "log" "net/http" ) func main() { body := []byte(`{ "assigneeUserId": "string", "dueAt": "2026-01-01T00:00:00Z", "status": "string", "title": "string" }`) req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/incidents//action-items", bytes.NewReader(body)) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.Header.Set("Content-Type", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//action-items"; const response = await fetch(url, { method: "POST", headers: { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", }, credentials: "include", body: JSON.stringify({ "assigneeUserId": "string", "dueAt": "2026-01-01T00:00:00Z", "status": "string", "title": "string" }), }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. using System; using System.Net.Http; using System.Text; using var client = new HttpClient(); const string body = """ { "assigneeUserId": "string", "dueAt": "2026-01-01T00:00:00Z", "status": "string", "title": "string" } """; var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/incidents//action-items"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); request.Content = new StringContent(body, Encoding.UTF8, "application/json"); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### PATCH `/api/v1/incidents/{incidentId}/action-items/{itemId}` {#depot.incidents.updateActionItem} **Update incident action item** #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | | `itemId` | path | string | Yes | A uuid. | #### Request body Required, sent as `application/json`. #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, IncidentActionItemView | Success. | | `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | This incident has been deleted. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X PATCH 'https://depot.example.com/api/v1/incidents//action-items/' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -b 'outpost_console=' \ --data '{ "assigneeUserId": "string", "dueAt": "2026-01-01T00:00:00Z", "status": "string", "title": "string" }' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Content-Type' = 'application/json' 'Cookie' = 'outpost_console=' } $body = @' { "assigneeUserId": "string", "dueAt": "2026-01-01T00:00:00Z", "status": "string", "title": "string" } '@ $response = Invoke-RestMethod ` -Method Patch ` -Uri 'https://depot.example.com/api/v1/incidents//action-items/' ` -Headers $headers ` -ContentType 'application/json' ` -Body $body $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//action-items/" headers = { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", } cookies = { "outpost_console": "", } payload = { "assigneeUserId": "string", "dueAt": "2026-01-01T00:00:00Z", "status": "string", "title": "string", } response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "bytes" "fmt" "io" "log" "net/http" ) func main() { body := []byte(`{ "assigneeUserId": "string", "dueAt": "2026-01-01T00:00:00Z", "status": "string", "title": "string" }`) req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/incidents//action-items/", bytes.NewReader(body)) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.Header.Set("Content-Type", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//action-items/"; const response = await fetch(url, { method: "PATCH", headers: { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", }, credentials: "include", body: JSON.stringify({ "assigneeUserId": "string", "dueAt": "2026-01-01T00:00:00Z", "status": "string", "title": "string" }), }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using System.Text; using var client = new HttpClient(); const string body = """ { "assigneeUserId": "string", "dueAt": "2026-01-01T00:00:00Z", "status": "string", "title": "string" } """; var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/incidents//action-items/"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); request.Content = new StringContent(body, Encoding.UTF8, "application/json"); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### POST `/api/v1/incidents/{incidentId}/action-items/{itemId}/ticket` {#depot.incidents.spawnActionItemTicket} **spawnActionItemTicket opens an ORDINARY ticket for the item and links all three rows.** An item that already has a ticket is returned unchanged rather than given a second one: the console offers this from two places, and two tickets for one agreed fix is how remediation ends up half-done in each. #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | | `itemId` | path | string | Yes | A uuid. | #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, IncidentActionItemView | Success. | | `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | This incident has been deleted. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X POST 'https://depot.example.com/api/v1/incidents//action-items//ticket' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Post ` -Uri 'https://depot.example.com/api/v1/incidents//action-items//ticket' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//action-items//ticket" headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.post(url, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/incidents//action-items//ticket", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//action-items//ticket"; const response = await fetch(url, { method: "POST", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/incidents//action-items//ticket"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### GET `/api/v1/incidents/{incidentId}/alerts` {#depot.incidents.listAlertLinks} **List incident alert links** #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, array of IncidentAlertLinkView | Success. | | `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:read. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X GET 'https://depot.example.com/api/v1/incidents//alerts' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Get ` -Uri 'https://depot.example.com/api/v1/incidents//alerts' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//alerts" headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.get(url, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents//alerts", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//alerts"; const response = await fetch(url, { method: "GET", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents//alerts"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### POST `/api/v1/incidents/{incidentId}/alerts` {#depot.incidents.linkAlert} **Link incident alert** #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Request body Required, sent as `application/json`. #### Responses | Status | Body | Description | | --- | --- | --- | | `204` | None | Success, with no body. | | `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | This incident has been deleted. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X POST 'https://depot.example.com/api/v1/incidents//alerts' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -b 'outpost_console=' \ --data '{ "alertId": "string", "kind": "string", "ticketId": "string" }' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Content-Type' = 'application/json' 'Cookie' = 'outpost_console=' } $body = @' { "alertId": "string", "kind": "string", "ticketId": "string" } '@ $response = Invoke-RestMethod ` -Method Post ` -Uri 'https://depot.example.com/api/v1/incidents//alerts' ` -Headers $headers ` -ContentType 'application/json' ` -Body $body $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//alerts" headers = { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", } cookies = { "outpost_console": "", } payload = { "alertId": "string", "kind": "string", "ticketId": "string", } response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "bytes" "fmt" "io" "log" "net/http" ) func main() { body := []byte(`{ "alertId": "string", "kind": "string", "ticketId": "string" }`) req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/incidents//alerts", bytes.NewReader(body)) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.Header.Set("Content-Type", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//alerts"; const response = await fetch(url, { method: "POST", headers: { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", }, credentials: "include", body: JSON.stringify({ "alertId": "string", "kind": "string", "ticketId": "string" }), }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using System.Text; using var client = new HttpClient(); const string body = """ { "alertId": "string", "kind": "string", "ticketId": "string" } """; var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/incidents//alerts"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); request.Content = new StringContent(body, Encoding.UTF8, "application/json"); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### DELETE `/api/v1/incidents/{incidentId}/alerts/{alertId}` {#depot.incidents.unlinkAlert} **Unlink incident alert** #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `alertId` | path | string | Yes | A uuid. | | `incidentId` | path | string | Yes | A uuid. | #### Responses | Status | Body | Description | | --- | --- | --- | | `204` | None | Success, with no body. | | `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | This incident has been deleted. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X DELETE 'https://depot.example.com/api/v1/incidents//alerts/' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Delete ` -Uri 'https://depot.example.com/api/v1/incidents//alerts/' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//alerts/" headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.delete(url, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/incidents//alerts/", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//alerts/"; const response = await fetch(url, { method: "DELETE", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/incidents//alerts/"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### GET `/api/v1/incidents/{incidentId}/components` {#depot.incidents.listImpacts} **List incident impacts** #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, array of IncidentImpactView | Success. | | `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:read. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X GET 'https://depot.example.com/api/v1/incidents//components' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Get ` -Uri 'https://depot.example.com/api/v1/incidents//components' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//components" headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.get(url, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents//components", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//components"; const response = await fetch(url, { method: "GET", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents//components"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### PUT `/api/v1/incidents/{incidentId}/components` {#depot.incidents.replaceImpacts} **replaceIncidentImpacts sets the whole set.** A PUT and not a POST because the body is the complete list: the console renders checkboxes, and the store preserves each surviving component's StartedAt so re-saving an unchanged list does not restart an outage clock. #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Request body Required, sent as `application/json`. #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, array of IncidentImpactView | Success. | | `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | This incident has been deleted. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X PUT 'https://depot.example.com/api/v1/incidents//components' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -b 'outpost_console=' \ --data '{ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Content-Type' = 'application/json' 'Cookie' = 'outpost_console=' } $body = @' { "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" } '@ $response = Invoke-RestMethod ` -Method Put ` -Uri 'https://depot.example.com/api/v1/incidents//components' ` -Headers $headers ` -ContentType 'application/json' ` -Body $body $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//components" headers = { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", } cookies = { "outpost_console": "", } payload = { "components": [ { "componentId": "string", "impact": "string", }, ], "initialUpdate": "string", "initialUpdateIsPublic": False, "internalNotes": "string", "isPublic": False, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string", }, ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string", }, "title": "string", } response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "bytes" "fmt" "io" "log" "net/http" ) func main() { body := []byte(`{ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }`) req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/incidents//components", bytes.NewReader(body)) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.Header.Set("Content-Type", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//components"; const response = await fetch(url, { method: "PUT", headers: { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", }, credentials: "include", body: JSON.stringify({ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }), }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using System.Text; using var client = new HttpClient(); const string body = """ { "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" } """; var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/incidents//components"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); request.Content = new StringContent(body, Encoding.UTF8, "application/json"); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### PUT `/api/v1/incidents/{incidentId}/postmortem` {#depot.incidents.publishPostmortem} **publishPostmortem writes the analysis and moves the incident into 'postmortem', which is the only way into that status and is reachable only from 'resolved'.** An incident cannot be analysed before it has ended. #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Request body Required, sent as `application/json`. #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, IncidentView | Success. | | `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | This incident has been deleted. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X PUT 'https://depot.example.com/api/v1/incidents//postmortem' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -b 'outpost_console=' \ --data '{ "body": "string" }' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Content-Type' = 'application/json' 'Cookie' = 'outpost_console=' } $body = @' { "body": "string" } '@ $response = Invoke-RestMethod ` -Method Put ` -Uri 'https://depot.example.com/api/v1/incidents//postmortem' ` -Headers $headers ` -ContentType 'application/json' ` -Body $body $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//postmortem" headers = { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", } cookies = { "outpost_console": "", } payload = { "body": "string", } response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "bytes" "fmt" "io" "log" "net/http" ) func main() { body := []byte(`{ "body": "string" }`) req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/incidents//postmortem", bytes.NewReader(body)) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.Header.Set("Content-Type", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//postmortem"; const response = await fetch(url, { method: "PUT", headers: { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", }, credentials: "include", body: JSON.stringify({ "body": "string" }), }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using System.Text; using var client = new HttpClient(); const string body = """ { "body": "string" } """; var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/incidents//postmortem"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); request.Content = new StringContent(body, Encoding.UTF8, "application/json"); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### GET `/api/v1/incidents/{incidentId}/roles` {#depot.incidents.listRoles} **List incident roles** #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, array of IncidentRoleView | Success. | | `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:read. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X GET 'https://depot.example.com/api/v1/incidents//roles' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Get ` -Uri 'https://depot.example.com/api/v1/incidents//roles' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//roles" headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.get(url, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents//roles", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//roles"; const response = await fetch(url, { method: "GET", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents//roles"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### PUT `/api/v1/incidents/{incidentId}/roles` {#depot.incidents.replaceRoles} **replaceIncidentRoles writes the whole set in one transaction, which is what makes a commander handover a swap rather than a moment with two.** A body naming two commanders answers 409 from the partial unique index, not a half-applied set. #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Request body Required, sent as `application/json`. #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, array of IncidentRoleView | Success. | | `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | This incident has been deleted. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X PUT 'https://depot.example.com/api/v1/incidents//roles' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -b 'outpost_console=' \ --data '{ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Content-Type' = 'application/json' 'Cookie' = 'outpost_console=' } $body = @' { "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" } '@ $response = Invoke-RestMethod ` -Method Put ` -Uri 'https://depot.example.com/api/v1/incidents//roles' ` -Headers $headers ` -ContentType 'application/json' ` -Body $body $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//roles" headers = { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", } cookies = { "outpost_console": "", } payload = { "components": [ { "componentId": "string", "impact": "string", }, ], "initialUpdate": "string", "initialUpdateIsPublic": False, "internalNotes": "string", "isPublic": False, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string", }, ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string", }, "title": "string", } response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "bytes" "fmt" "io" "log" "net/http" ) func main() { body := []byte(`{ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }`) req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/incidents//roles", bytes.NewReader(body)) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.Header.Set("Content-Type", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//roles"; const response = await fetch(url, { method: "PUT", headers: { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", }, credentials: "include", body: JSON.stringify({ "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" }), }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using System.Text; using var client = new HttpClient(); const string body = """ { "components": [ { "componentId": "string", "impact": "string" } ], "initialUpdate": "string", "initialUpdateIsPublic": false, "internalNotes": "string", "isPublic": false, "publicSummary": "string", "roles": [ { "role": "string", "userId": "string" } ], "severity": "string", "startedAt": "2026-01-01T00:00:00Z", "templateId": "string", "templateVars": { "clientName": "string", "components": "string", "severity": "string", "startedAt": "string", "status": "string", "title": "string" }, "title": "string" } """; var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/incidents//roles"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); request.Content = new StringContent(body, Encoding.UTF8, "application/json"); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### GET `/api/v1/incidents/{incidentId}/tickets` {#depot.incidents.listTicketLinks} **List incident ticket links** #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, array of IncidentTicketLinkView | Success. | | `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:read. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X GET 'https://depot.example.com/api/v1/incidents//tickets' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Get ` -Uri 'https://depot.example.com/api/v1/incidents//tickets' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//tickets" headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.get(url, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents//tickets", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//tickets"; const response = await fetch(url, { method: "GET", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents//tickets"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### POST `/api/v1/incidents/{incidentId}/tickets` {#depot.incidents.linkTicket} **Link incident ticket** #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Request body Required, sent as `application/json`. #### Responses | Status | Body | Description | | --- | --- | --- | | `204` | None | Success, with no body. | | `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | This incident has been deleted. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X POST 'https://depot.example.com/api/v1/incidents//tickets' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -b 'outpost_console=' \ --data '{ "alertId": "string", "kind": "string", "ticketId": "string" }' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Content-Type' = 'application/json' 'Cookie' = 'outpost_console=' } $body = @' { "alertId": "string", "kind": "string", "ticketId": "string" } '@ $response = Invoke-RestMethod ` -Method Post ` -Uri 'https://depot.example.com/api/v1/incidents//tickets' ` -Headers $headers ` -ContentType 'application/json' ` -Body $body $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//tickets" headers = { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", } cookies = { "outpost_console": "", } payload = { "alertId": "string", "kind": "string", "ticketId": "string", } response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "bytes" "fmt" "io" "log" "net/http" ) func main() { body := []byte(`{ "alertId": "string", "kind": "string", "ticketId": "string" }`) req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/incidents//tickets", bytes.NewReader(body)) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.Header.Set("Content-Type", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//tickets"; const response = await fetch(url, { method: "POST", headers: { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", }, credentials: "include", body: JSON.stringify({ "alertId": "string", "kind": "string", "ticketId": "string" }), }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using System.Text; using var client = new HttpClient(); const string body = """ { "alertId": "string", "kind": "string", "ticketId": "string" } """; var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/incidents//tickets"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); request.Content = new StringContent(body, Encoding.UTF8, "application/json"); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### DELETE `/api/v1/incidents/{incidentId}/tickets/{ticketId}` {#depot.incidents.unlinkTicket} **Unlink incident ticket** #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | | `ticketId` | path | string | Yes | A uuid. | #### Responses | Status | Body | Description | | --- | --- | --- | | `204` | None | Success, with no body. | | `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | This incident has been deleted. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X DELETE 'https://depot.example.com/api/v1/incidents//tickets/' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Delete ` -Uri 'https://depot.example.com/api/v1/incidents//tickets/' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//tickets/" headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.delete(url, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/incidents//tickets/", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//tickets/"; const response = await fetch(url, { method: "DELETE", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/incidents//tickets/"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### GET `/api/v1/incidents/{incidentId}/updates` {#depot.incidents.listUpdates} **listIncidentUpdates returns the whole timeline, private entries included.** This is the ADMIN face; the public page's read is the statuspage package's and passes includePrivate false. #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | | `page` | query | integer | No | One-based page number. Defaults to 1. | | `pageSize` | query | integer | No | Rows per page, 1 to 200. Defaults to 50. | #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, PagedResultIncidentUpdateView | Success. | | `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:read. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X GET 'https://depot.example.com/api/v1/incidents//updates?page=0&pageSize=0' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Get ` -Uri 'https://depot.example.com/api/v1/incidents//updates?page=0&pageSize=0' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents//updates" params = { "page": "0", "pageSize": "0", } headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents//updates?page=0&pageSize=0", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = new URL("https://depot.example.com/api/v1/incidents//updates"); url.searchParams.set("page", "0"); url.searchParams.set("pageSize", "0"); const response = await fetch(url, { method: "GET", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents//updates?page=0&pageSize=0"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### POST `/api/v1/incidents/{incidentId}/updates` {#depot.incidents.appendUpdate} **appendIncidentUpdate is the ONLY way an incident's status moves.** The response carries both halves - the entry that was written and the incident as it now stands - because the console needs the second to re-render the header and a follow-up GET would race the next operator's update. #### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `incidentId` | path | string | Yes | A uuid. | #### Request body Required, sent as `application/json`. #### Responses | Status | Body | Description | | --- | --- | --- | | `201` | `application/json`, object | Created. | | `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:manage. | | `404` | `application/problem+json`, ProblemDetails | No resource matches that id. | | `409` | `application/problem+json`, ProblemDetails | This incident has been deleted. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | | `503` | `application/problem+json`, ProblemDetails | The request was refused. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. curl -X POST 'https://depot.example.com/api/v1/incidents//updates' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -b 'outpost_console=' \ --data '{ "at": "2026-01-01T00:00:00Z", "body": "string", "isPublic": false, "status": "string" }' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Content-Type' = 'application/json' 'Cookie' = 'outpost_console=' } $body = @' { "at": "2026-01-01T00:00:00Z", "body": "string", "isPublic": false, "status": "string" } '@ $response = Invoke-RestMethod ` -Method Post ` -Uri 'https://depot.example.com/api/v1/incidents//updates' ` -Headers $headers ` -ContentType 'application/json' ` -Body $body $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. import requests url = "https://depot.example.com/api/v1/incidents//updates" headers = { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", } cookies = { "outpost_console": "", } payload = { "at": "2026-01-01T00:00:00Z", "body": "string", "isPublic": False, "status": "string", } response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. package main import ( "bytes" "fmt" "io" "log" "net/http" ) func main() { body := []byte(`{ "at": "2026-01-01T00:00:00Z", "body": "string", "isPublic": false, "status": "string" }`) req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/incidents//updates", bytes.NewReader(body)) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.Header.Set("Content-Type", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents//updates"; const response = await fetch(url, { method: "POST", headers: { "X-CSRF-Token": "", "Accept": "application/json", "Content-Type": "application/json", }, credentials: "include", body: JSON.stringify({ "at": "2026-01-01T00:00:00Z", "body": "string", "isPublic": false, "status": "string" }), }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. using System; using System.Net.Http; using System.Text; using var client = new HttpClient(); const string body = """ { "at": "2026-01-01T00:00:00Z", "body": "string", "isPublic": false, "status": "string" } """; var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/incidents//updates"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); request.Content = new StringContent(body, Encoding.UTF8, "application/json"); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` ### GET `/api/v1/incidents/metrics` {#depot.incidents.metrics} **Incident metrics** #### Responses | Status | Body | Description | | --- | --- | --- | | `200` | `application/json`, IncidentMetricsView | Success. | | `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. | | `401` | `application/problem+json`, ProblemDetails | No signed-in identity. | | `403` | `application/problem+json`, ProblemDetails | The identity does not hold incident:read. | | `500` | `application/problem+json`, ProblemDetails | No client store in request context. | #### Request samples ```bash # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. curl -X GET 'https://depot.example.com/api/v1/incidents/metrics' \ -H 'X-CSRF-Token: ' \ -H 'Accept: application/json' \ -b 'outpost_console=' ``` ```powershell # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. $headers = @{ 'X-CSRF-Token' = '' 'Accept' = 'application/json' 'Cookie' = 'outpost_console=' } $response = Invoke-RestMethod ` -Method Get ` -Uri 'https://depot.example.com/api/v1/incidents/metrics' ` -Headers $headers $response | ConvertTo-Json -Depth 10 ``` ```python # Sign in first. outpost_console is a session cookie, so send it with every request. # This operation is idempotent. Repeating it does not repeat its effect. import requests url = "https://depot.example.com/api/v1/incidents/metrics" headers = { "X-CSRF-Token": "", "Accept": "application/json", } cookies = { "outpost_console": "", } response = requests.get(url, headers=headers, cookies=cookies, timeout=30) response.raise_for_status() print(response.json()) ``` ```go // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. package main import ( "fmt" "io" "log" "net/http" ) func main() { req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/incidents/metrics", nil) if err != nil { log.Fatal(err) } req.Header.Set("X-CSRF-Token", "") req.Header.Set("Accept", "application/json") req.AddCookie(&http.Cookie{Name: "outpost_console", Value: ""}) resp, err := http.DefaultClient.Do(req) if err != nil { log.Fatal(err) } defer resp.Body.Close() out, err := io.ReadAll(resp.Body) if err != nil { log.Fatal(err) } fmt.Println(resp.Status, string(out)) } ``` ```ts // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. // The session cookie is set by signing in. A script cannot set it itself. const url = "https://depot.example.com/api/v1/incidents/metrics"; const response = await fetch(url, { method: "GET", headers: { "X-CSRF-Token": "", "Accept": "application/json", }, credentials: "include", }); if (!response.ok) { throw new Error(`Request failed with status ${response.status}`); } const data = await response.json(); console.log(data); ``` ```csharp // Sign in first. outpost_console is a session cookie, so send it with every request. // This operation is idempotent. Repeating it does not repeat its effect. using System; using System.Net.Http; using var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/incidents/metrics"); request.Headers.TryAddWithoutValidation("X-CSRF-Token", ""); request.Headers.TryAddWithoutValidation("Accept", "application/json"); request.Headers.TryAddWithoutValidation("Cookie", "outpost_console="); var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ```