Depot mspincidents

Registers the MSP-wide incident routes on the CONTROL-PLANE mux.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/msp/incidents

GETincident:readmsp facemspIdempotent

Source: [object Object]

List msp incidents

Parameters

Name	In	Type	Required	Description
componentId	query	string	No
dir	query	string, one of asc, desc	No	Sort direction.
openOnly	query	string	No
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
publicOnly	query	string	No
q	query	string	No	Free-text search term.
sort	query	string, one of created, severity, started, title, updated	No	Sort key.

Responses

Status	Body	Description
200	application/json, PagedResultMspIncidentView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:read.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
itemsrequired	array of MspIncidentView
items[].acknowledgedAt	string (date-time) or null
items[].affectsAllClientsrequired	boolean
items[].createdAtrequired	string (date-time)
items[].createdBy	string
items[].deletedAt	string (date-time) or null
items[].internalNotes	string
items[].isPublicrequired	boolean
items[].postmortemBody	string
items[].postmortemPublishedAt	string (date-time) or null
items[].publicIdrequired	string
items[].publicSummary	string
items[].resolvedAt	string (date-time) or null
items[].severityrequired	string
items[].startedAtrequired	string (date-time)
items[].statusrequired	string
items[].titlerequired	string
items[].updatedAtrequired	string (date-time)
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/msp/incidents?componentId=<componentId>&dir=asc&openOnly=<openOnly>&page=0&pageSize=0&publicOnly=<publicOnly>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/msp/incidents?componentId=<componentId>&dir=asc&openOnly=<openOnly>&page=0&pageSize=0&publicOnly=<publicOnly>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/incidents"
params = {
    "componentId": "<componentId>",
    "dir": "asc",
    "openOnly": "<openOnly>",
    "page": "0",
    "pageSize": "0",
    "publicOnly": "<publicOnly>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/msp/incidents?componentId=<componentId>&dir=asc&openOnly=<openOnly>&page=0&pageSize=0&publicOnly=<publicOnly>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/msp/incidents");
url.searchParams.set("componentId", "<componentId>");
url.searchParams.set("dir", "asc");
url.searchParams.set("openOnly", "<openOnly>");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");
url.searchParams.set("publicOnly", "<publicOnly>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/msp/incidents?componentId=<componentId>&dir=asc&openOnly=<openOnly>&page=0&pageSize=0&publicOnly=<publicOnly>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/msp/incidents

POSTincident:managemsp facemsp

Source: [object Object]

createMspIncident declares an estate-wide incident.

AcknowledgedAt is stamped at creation for incident.Service.CreateIncident’s reason: somebody opened the console, typed a title and pressed declare, so the incident has been acknowledged by definition.

Request body

Required, sent as application/json.

Field	Type	Description
affectsAllClients	boolean or null
componentsrequired	array of IncidentImpactRequest
components[].componentIdrequired	string
components[].impactrequired	string
initialUpdate	string or null
initialUpdateIsPublic	boolean or null
internalNotes	string or null
isPublic	boolean or null
publicSummary	string or null
rolesrequired	array of IncidentRoleRequest
roles[].rolerequired	string
roles[].userIdrequired	string
severity	string or null
startedAt	string (date-time) or null
templateId	string or null
templateVars	IncidentTemplateVarsDTO	incidentTemplateVarsDTO is the closed render context.
templateVars.clientNamerequired	string
templateVars.componentsrequired	string
templateVars.severityrequired	string
templateVars.startedAtrequired	string
templateVars.statusrequired	string
templateVars.titlerequired	string
title	string or null

Responses

Status	Body	Description
201	application/json, MspIncidentView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	That component no longer exists.
409	application/problem+json, ProblemDetails	An incident with that id already exists.
500	application/problem+json, ProblemDetails	Could not declare the incident.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

201 response body

Field	Type	Description
acknowledgedAt	string (date-time) or null
affectsAllClientsrequired	boolean
createdAtrequired	string (date-time)
createdBy	string
deletedAt	string (date-time) or null
internalNotes	string
isPublicrequired	boolean
postmortemBody	string
postmortemPublishedAt	string (date-time) or null
publicIdrequired	string
publicSummary	string
resolvedAt	string (date-time) or null
severityrequired	string
startedAtrequired	string (date-time)
statusrequired	string
titlerequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/msp/incidents' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "affectsAllClients": false,
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "affectsAllClients": false,
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/msp/incidents' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/msp/incidents"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "affectsAllClients": False,
    "components": [
        {
            "componentId": "string",
            "impact": "string",
        },
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": False,
    "internalNotes": "string",
    "isPublic": False,
    "publicSummary": "string",
    "roles": [
        {
            "role": "string",
            "userId": "string",
        },
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
        "clientName": "string",
        "components": "string",
        "severity": "string",
        "startedAt": "string",
        "status": "string",
        "title": "string",
    },
    "title": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "affectsAllClients": false,
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/msp/incidents", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/incidents";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "affectsAllClients": false,
    "components": [
      {
        "componentId": "string",
        "impact": "string"
      }
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": false,
    "internalNotes": "string",
    "isPublic": false,
    "publicSummary": "string",
    "roles": [
      {
        "role": "string",
        "userId": "string"
      }
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
      "clientName": "string",
      "components": "string",
      "severity": "string",
      "startedAt": "string",
      "status": "string",
      "title": "string"
    },
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "affectsAllClients": false,
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/msp/incidents");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/msp/incidents/{incidentId}

GETincident:readmsp facemspIdempotent

Source: [object Object]

Get msp incident

Parameters

Name	In	Type	Required	Description
incidentId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, MspIncidentView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the incident.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
acknowledgedAt	string (date-time) or null
affectsAllClientsrequired	boolean
createdAtrequired	string (date-time)
createdBy	string
deletedAt	string (date-time) or null
internalNotes	string
isPublicrequired	boolean
postmortemBody	string
postmortemPublishedAt	string (date-time) or null
publicIdrequired	string
publicSummary	string
resolvedAt	string (date-time) or null
severityrequired	string
startedAtrequired	string (date-time)
statusrequired	string
titlerequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/msp/incidents/<incidentId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/msp/incidents/<incidentId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/msp/incidents/<incidentId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/msp/incidents/<incidentId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/msp/incidents/{incidentId}

PATCHincident:managemsp facemspIdempotent

Source: [object Object]

patchMspIncident edits the descriptive half and the fan-out switch.

It CANNOT move the status; moving an MSP-wide incident is POST /updates, for incidents.go decision 2’s reason.

Parameters

Name	In	Type	Required	Description
incidentId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
affectsAllClients	boolean or null
componentsrequired	array of IncidentImpactRequest
components[].componentIdrequired	string
components[].impactrequired	string
initialUpdate	string or null
initialUpdateIsPublic	boolean or null
internalNotes	string or null
isPublic	boolean or null
publicSummary	string or null
rolesrequired	array of IncidentRoleRequest
roles[].rolerequired	string
roles[].userIdrequired	string
severity	string or null
startedAt	string (date-time) or null
templateId	string or null
templateVars	IncidentTemplateVarsDTO	incidentTemplateVarsDTO is the closed render context.
templateVars.clientNamerequired	string
templateVars.componentsrequired	string
templateVars.severityrequired	string
templateVars.startedAtrequired	string
templateVars.statusrequired	string
templateVars.titlerequired	string
title	string or null

Responses

Status	Body	Description
200	application/json, MspIncidentView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	This incident has been deleted.
500	application/problem+json, ProblemDetails	Could not read the incident.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
acknowledgedAt	string (date-time) or null
affectsAllClientsrequired	boolean
createdAtrequired	string (date-time)
createdBy	string
deletedAt	string (date-time) or null
internalNotes	string
isPublicrequired	boolean
postmortemBody	string
postmortemPublishedAt	string (date-time) or null
publicIdrequired	string
publicSummary	string
resolvedAt	string (date-time) or null
severityrequired	string
startedAtrequired	string (date-time)
statusrequired	string
titlerequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PATCH 'https://depot.example.com/api/v1/msp/incidents/<incidentId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "affectsAllClients": false,
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "affectsAllClients": false,
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/msp/incidents/<incidentId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "affectsAllClients": False,
    "components": [
        {
            "componentId": "string",
            "impact": "string",
        },
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": False,
    "internalNotes": "string",
    "isPublic": False,
    "publicSummary": "string",
    "roles": [
        {
            "role": "string",
            "userId": "string",
        },
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
        "clientName": "string",
        "components": "string",
        "severity": "string",
        "startedAt": "string",
        "status": "string",
        "title": "string",
    },
    "title": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "affectsAllClients": false,
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/msp/incidents/<incidentId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "affectsAllClients": false,
    "components": [
      {
        "componentId": "string",
        "impact": "string"
      }
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": false,
    "internalNotes": "string",
    "isPublic": false,
    "publicSummary": "string",
    "roles": [
      {
        "role": "string",
        "userId": "string"
      }
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
      "clientName": "string",
      "components": "string",
      "severity": "string",
      "startedAt": "string",
      "status": "string",
      "title": "string"
    },
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "affectsAllClients": false,
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/msp/incidents/<incidentId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/v1/msp/incidents/{incidentId}

DELETEincident:managemsp facemspIdempotent

Source: [object Object]

deleteMspIncident retires one.

A SOFT delete: it comes off every tenant’s page without coming out of the database.

NOTHING IS EMITTED. The tenant face does not emit on a delete either, and here it would be worse: the estate has already been told this incident exists, and a retraction to every tenant’s subscribers is an announcement nobody can recall. Taking it off the pages is the whole of the act.

Parameters

Name	In	Type	Required	Description
incidentId	path	string	Yes	A uuid.

Responses

Status	Body	Description
204	None	Success, with no body.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the incident.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/msp/incidents/<incidentId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/msp/incidents/<incidentId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/msp/incidents/<incidentId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/msp/incidents/<incidentId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/msp/incidents/{incidentId}/components

GETincident:readmsp facemspIdempotent

Source: [object Object]

List msp incident impacts

Parameters

Name	In	Type	Required	Description
incidentId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, array of IncidentImpactView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the incident.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
[].componentIdrequired	string
[].componentName	string
[].endedAt	string (date-time) or null
[].impactrequired	string
[].startedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/msp/incidents/<incidentId>/components' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/msp/incidents/<incidentId>/components' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>/components"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/msp/incidents/<incidentId>/components", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>/components";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/msp/incidents/<incidentId>/components");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/msp/incidents/{incidentId}/components

PUTincident:managemsp facemspIdempotent

Source: [object Object]

replaceMspIncidentImpacts sets the whole set.

A PUT and not a POST because the body is the complete list, and the store preserves each surviving component’s StartedAt so re-saving an unchanged list does not restart an outage clock.

Parameters

Name	In	Type	Required	Description
incidentId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
affectsAllClients	boolean or null
componentsrequired	array of IncidentImpactRequest
components[].componentIdrequired	string
components[].impactrequired	string
initialUpdate	string or null
initialUpdateIsPublic	boolean or null
internalNotes	string or null
isPublic	boolean or null
publicSummary	string or null
rolesrequired	array of IncidentRoleRequest
roles[].rolerequired	string
roles[].userIdrequired	string
severity	string or null
startedAt	string (date-time) or null
templateId	string or null
templateVars	IncidentTemplateVarsDTO	incidentTemplateVarsDTO is the closed render context.
templateVars.clientNamerequired	string
templateVars.componentsrequired	string
templateVars.severityrequired	string
templateVars.startedAtrequired	string
templateVars.statusrequired	string
templateVars.titlerequired	string
title	string or null

Responses

Status	Body	Description
200	application/json, array of IncidentImpactView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	This incident has been deleted.
500	application/problem+json, ProblemDetails	Could not read the incident.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
[].componentIdrequired	string
[].componentName	string
[].endedAt	string (date-time) or null
[].impactrequired	string
[].startedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/msp/incidents/<incidentId>/components' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "affectsAllClients": false,
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "affectsAllClients": false,
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/msp/incidents/<incidentId>/components' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>/components"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "affectsAllClients": False,
    "components": [
        {
            "componentId": "string",
            "impact": "string",
        },
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": False,
    "internalNotes": "string",
    "isPublic": False,
    "publicSummary": "string",
    "roles": [
        {
            "role": "string",
            "userId": "string",
        },
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
        "clientName": "string",
        "components": "string",
        "severity": "string",
        "startedAt": "string",
        "status": "string",
        "title": "string",
    },
    "title": "string",
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "affectsAllClients": false,
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/msp/incidents/<incidentId>/components", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>/components";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "affectsAllClients": false,
    "components": [
      {
        "componentId": "string",
        "impact": "string"
      }
    ],
    "initialUpdate": "string",
    "initialUpdateIsPublic": false,
    "internalNotes": "string",
    "isPublic": false,
    "publicSummary": "string",
    "roles": [
      {
        "role": "string",
        "userId": "string"
      }
    ],
    "severity": "string",
    "startedAt": "2026-01-01T00:00:00Z",
    "templateId": "string",
    "templateVars": {
      "clientName": "string",
      "components": "string",
      "severity": "string",
      "startedAt": "string",
      "status": "string",
      "title": "string"
    },
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "affectsAllClients": false,
  "components": [
    {
      "componentId": "string",
      "impact": "string"
    }
  ],
  "initialUpdate": "string",
  "initialUpdateIsPublic": false,
  "internalNotes": "string",
  "isPublic": false,
  "publicSummary": "string",
  "roles": [
    {
      "role": "string",
      "userId": "string"
    }
  ],
  "severity": "string",
  "startedAt": "2026-01-01T00:00:00Z",
  "templateId": "string",
  "templateVars": {
    "clientName": "string",
    "components": "string",
    "severity": "string",
    "startedAt": "string",
    "status": "string",
    "title": "string"
  },
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/msp/incidents/<incidentId>/components");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/msp/incidents/{incidentId}/postmortem

PUTincident:managemsp facemspIdempotent

Source: [object Object]

publishMspPostmortem writes the analysis and moves the incident into ‘postmortem’, which is the only way into that status and is reachable only from ‘resolved’.

An incident cannot be analysed before it has ended.

IT EMITS NOTHING, matching the tenant face. A postmortem is read by whoever goes looking, days later; mailing every tenant’s subscribers a second time about an incident that ended last week is how a status page trains its readers to filter it.

Parameters

Name	In	Type	Required	Description
incidentId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
body	string or null

Responses

Status	Body	Description
200	application/json, MspIncidentView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	This incident has been deleted.
500	application/problem+json, ProblemDetails	Could not read the incident.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
acknowledgedAt	string (date-time) or null
affectsAllClientsrequired	boolean
createdAtrequired	string (date-time)
createdBy	string
deletedAt	string (date-time) or null
internalNotes	string
isPublicrequired	boolean
postmortemBody	string
postmortemPublishedAt	string (date-time) or null
publicIdrequired	string
publicSummary	string
resolvedAt	string (date-time) or null
severityrequired	string
startedAtrequired	string (date-time)
statusrequired	string
titlerequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/msp/incidents/<incidentId>/postmortem' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "body": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "body": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/msp/incidents/<incidentId>/postmortem' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>/postmortem"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "body": "string",
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "body": "string"
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/msp/incidents/<incidentId>/postmortem", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>/postmortem";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "body": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "body": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/msp/incidents/<incidentId>/postmortem");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/msp/incidents/{incidentId}/updates

GETincident:readmsp facemspIdempotent

Source: [object Object]

listMspIncidentUpdates returns the whole timeline, private entries included.

This is the ADMIN face; the public page’s read passes includePrivate false.

Parameters

Name	In	Type	Required	Description
incidentId	path	string	Yes	A uuid.
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.

Responses

Status	Body	Description
200	application/json, PagedResultIncidentUpdateView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the incident.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
itemsrequired	array of IncidentUpdateView
items[].bodyrequired	string
items[].createdAtrequired	string (date-time)
items[].createdBy	string
items[].isPublicrequired	boolean
items[].publicIdrequired	string
items[].statusrequired	string
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/msp/incidents/<incidentId>/updates?page=0&pageSize=0' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/msp/incidents/<incidentId>/updates?page=0&pageSize=0' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>/updates"
params = {
    "page": "0",
    "pageSize": "0",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/msp/incidents/<incidentId>/updates?page=0&pageSize=0", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/msp/incidents/<incidentId>/updates");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/msp/incidents/<incidentId>/updates?page=0&pageSize=0");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/msp/incidents/{incidentId}/updates

POSTincident:managemsp facemsp

Source: [object Object]

appendMspIncidentUpdate is the ONLY way an MSP-wide incident’s status moves.

The transition is checked BEFORE anything is written, because the update table is append-only: a statement written and then found to be illegal could not be taken back.

Parameters

Name	In	Type	Required	Description
incidentId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
at	string (date-time) or null
body	string or null
isPublic	boolean or null
status	string or null

Responses

Status	Body	Description
201	application/json, object	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	This incident has been deleted.
500	application/problem+json, ProblemDetails	Could not read the incident.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/msp/incidents/<incidentId>/updates' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "at": "2026-01-01T00:00:00Z",
  "body": "string",
  "isPublic": false,
  "status": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "at": "2026-01-01T00:00:00Z",
  "body": "string",
  "isPublic": false,
  "status": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/msp/incidents/<incidentId>/updates' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>/updates"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "at": "2026-01-01T00:00:00Z",
    "body": "string",
    "isPublic": False,
    "status": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "at": "2026-01-01T00:00:00Z",
  "body": "string",
  "isPublic": false,
  "status": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/msp/incidents/<incidentId>/updates", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/incidents/<incidentId>/updates";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "at": "2026-01-01T00:00:00Z",
    "body": "string",
    "isPublic": false,
    "status": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "at": "2026-01-01T00:00:00Z",
  "body": "string",
  "isPublic": false,
  "status": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/msp/incidents/<incidentId>/updates");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/msp/maintenance-windows

GETincident:readmsp facemspIdempotent

Source: [object Object]

List msp maintenance windows

Parameters

Name	In	Type	Required	Description
dir	query	string, one of asc, desc	No	Sort direction.
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
q	query	string	No	Free-text search term.
sort	query	string, one of created, scheduled, title, updated	No	Sort key.

Responses

Status	Body	Description
200	application/json, PagedResultMspMaintenanceWindowView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:read.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
itemsrequired	array of MspMaintenanceWindowView
items[].affectsAllClientsrequired	boolean
items[].autoTransitionrequired	boolean
items[].body	string
items[].completedAt	string (date-time) or null
items[].components	array of StatusComponentView
items[].components[].createdAtrequired	string (date-time)
items[].components[].description	string
items[].components[].groupName	string
items[].components[].namerequired	string
items[].components[].publicIdrequired	string
items[].components[].showUptimerequired	boolean
items[].components[].sortOrderrequired	integer
items[].components[].statusrequired	string
items[].components[].updatedAtrequired	string (date-time)
items[].createdAtrequired	string (date-time)
items[].publicIdrequired	string
items[].scheduledEndAtrequired	string (date-time)
items[].scheduledStartAtrequired	string (date-time)
items[].startedAt	string (date-time) or null
items[].statusrequired	string
items[].titlerequired	string
items[].updatedAtrequired	string (date-time)
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/msp/maintenance-windows?dir=asc&page=0&pageSize=0&q=<q>&sort=created' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/msp/maintenance-windows?dir=asc&page=0&pageSize=0&q=<q>&sort=created' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/maintenance-windows"
params = {
    "dir": "asc",
    "page": "0",
    "pageSize": "0",
    "q": "<q>",
    "sort": "created",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/msp/maintenance-windows?dir=asc&page=0&pageSize=0&q=<q>&sort=created", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/msp/maintenance-windows");
url.searchParams.set("dir", "asc");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");
url.searchParams.set("q", "<q>");
url.searchParams.set("sort", "created");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/msp/maintenance-windows?dir=asc&page=0&pageSize=0&q=<q>&sort=created");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/msp/maintenance-windows

POSTincident:managemsp facemsp

Source: [object Object]

Create msp maintenance window

Request body

Required, sent as application/json.

Field	Type	Description
affectsAllClients	boolean or null
autoTransition	boolean or null
body	string or null
componentIdsrequired	array of string
scheduledEndAt	string (date-time) or null
scheduledStartAt	string (date-time) or null
title	string or null

Responses

Status	Body	Description
201	application/json, MspMaintenanceWindowView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	One of those components no longer exists.
500	application/problem+json, ProblemDetails	Could not schedule the planned work.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

201 response body

Field	Type	Description
affectsAllClientsrequired	boolean
autoTransitionrequired	boolean
body	string
completedAt	string (date-time) or null
components	array of StatusComponentView
components[].createdAtrequired	string (date-time)
components[].description	string
components[].groupName	string
components[].namerequired	string
components[].publicIdrequired	string
components[].showUptimerequired	boolean
components[].sortOrderrequired	integer
components[].statusrequired	string
components[].updatedAtrequired	string (date-time)
createdAtrequired	string (date-time)
publicIdrequired	string
scheduledEndAtrequired	string (date-time)
scheduledStartAtrequired	string (date-time)
startedAt	string (date-time) or null
statusrequired	string
titlerequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/msp/maintenance-windows' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "affectsAllClients": false,
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "affectsAllClients": false,
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/msp/maintenance-windows' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/msp/maintenance-windows"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "affectsAllClients": False,
    "autoTransition": False,
    "body": "string",
    "componentIds": [
        "string",
    ],
    "scheduledEndAt": "2026-01-01T00:00:00Z",
    "scheduledStartAt": "2026-01-01T00:00:00Z",
    "title": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "affectsAllClients": false,
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/msp/maintenance-windows", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/maintenance-windows";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "affectsAllClients": false,
    "autoTransition": false,
    "body": "string",
    "componentIds": [
      "string"
    ],
    "scheduledEndAt": "2026-01-01T00:00:00Z",
    "scheduledStartAt": "2026-01-01T00:00:00Z",
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "affectsAllClients": false,
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/msp/maintenance-windows");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/msp/maintenance-windows/{maintenanceId}

GETincident:readmsp facemspIdempotent

Source: [object Object]

Get msp maintenance window

Parameters

Name	In	Type	Required	Description
maintenanceId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, MspMaintenanceWindowView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the planned work.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
affectsAllClientsrequired	boolean
autoTransitionrequired	boolean
body	string
completedAt	string (date-time) or null
components	array of StatusComponentView
components[].createdAtrequired	string (date-time)
components[].description	string
components[].groupName	string
components[].namerequired	string
components[].publicIdrequired	string
components[].showUptimerequired	boolean
components[].sortOrderrequired	integer
components[].statusrequired	string
components[].updatedAtrequired	string (date-time)
createdAtrequired	string (date-time)
publicIdrequired	string
scheduledEndAtrequired	string (date-time)
scheduledStartAtrequired	string (date-time)
startedAt	string (date-time) or null
statusrequired	string
titlerequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/msp/maintenance-windows/{maintenanceId}

PATCHincident:managemsp facemsp

Source: [object Object]

patchMspMaintenanceWindow edits the announcement.

It cannot move the status; see maintenance.go decision 1.

Parameters

Name	In	Type	Required	Description
maintenanceId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
affectsAllClients	boolean or null
autoTransition	boolean or null
body	string or null
componentIdsrequired	array of string
scheduledEndAt	string (date-time) or null
scheduledStartAt	string (date-time) or null
title	string or null

Responses

Status	Body	Description
200	application/json, MspMaintenanceWindowView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the planned work.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
affectsAllClientsrequired	boolean
autoTransitionrequired	boolean
body	string
completedAt	string (date-time) or null
components	array of StatusComponentView
components[].createdAtrequired	string (date-time)
components[].description	string
components[].groupName	string
components[].namerequired	string
components[].publicIdrequired	string
components[].showUptimerequired	boolean
components[].sortOrderrequired	integer
components[].statusrequired	string
components[].updatedAtrequired	string (date-time)
createdAtrequired	string (date-time)
publicIdrequired	string
scheduledEndAtrequired	string (date-time)
scheduledStartAtrequired	string (date-time)
startedAt	string (date-time) or null
statusrequired	string
titlerequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X PATCH 'https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "affectsAllClients": false,
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "affectsAllClients": false,
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "affectsAllClients": False,
    "autoTransition": False,
    "body": "string",
    "componentIds": [
        "string",
    ],
    "scheduledEndAt": "2026-01-01T00:00:00Z",
    "scheduledStartAt": "2026-01-01T00:00:00Z",
    "title": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "affectsAllClients": false,
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "affectsAllClients": false,
    "autoTransition": false,
    "body": "string",
    "componentIds": [
      "string"
    ],
    "scheduledEndAt": "2026-01-01T00:00:00Z",
    "scheduledStartAt": "2026-01-01T00:00:00Z",
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "affectsAllClients": false,
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/msp/maintenance-windows/{maintenanceId}/transition

POSTincident:managemsp facemspIdempotent

Source: [object Object]

transitionMspMaintenanceWindow moves a window and stamps what actually happened.

ONE VERB ROUTE and not three, matching the tenant face and api-client.ts’s transitionMspMaintenanceWindow: start, complete and cancel are the same act with a different destination, and three routes would be three places to forget the transition check.

Parameters

Name	In	Type	Required	Description
maintenanceId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
at	string (date-time) or null
status	string or null

Responses

Status	Body	Description
200	application/json, MspMaintenanceWindowView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	Could not read the planned work.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
affectsAllClientsrequired	boolean
autoTransitionrequired	boolean
body	string
completedAt	string (date-time) or null
components	array of StatusComponentView
components[].createdAtrequired	string (date-time)
components[].description	string
components[].groupName	string
components[].namerequired	string
components[].publicIdrequired	string
components[].showUptimerequired	boolean
components[].sortOrderrequired	integer
components[].statusrequired	string
components[].updatedAtrequired	string (date-time)
createdAtrequired	string (date-time)
publicIdrequired	string
scheduledEndAtrequired	string (date-time)
scheduledStartAtrequired	string (date-time)
startedAt	string (date-time) or null
statusrequired	string
titlerequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>/transition' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "at": "2026-01-01T00:00:00Z",
  "status": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "at": "2026-01-01T00:00:00Z",
  "status": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>/transition' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>/transition"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "at": "2026-01-01T00:00:00Z",
    "status": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "at": "2026-01-01T00:00:00Z",
  "status": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>/transition", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>/transition";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "at": "2026-01-01T00:00:00Z",
    "status": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "at": "2026-01-01T00:00:00Z",
  "status": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/msp/maintenance-windows/<maintenanceId>/transition");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/msp/status-components

GETincident:readmsp facemspIdempotent

Source: [object Object]

listMspStatusComponents answers the MSP’s own component list, searched, sorted and paged exactly as the tenant one is - down to the same allowlist and the same envelope.

Two faces over the same table that answered different parameters would be the drift this file exists to avoid.

Parameters

Name	In	Type	Required	Description
dir	query	string, one of asc, desc	No	Sort direction.
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
q	query	string	No	Free-text search term.
sort	query	string, one of created, name, page, status, updated	No	Sort key.

Responses

Status	Body	Description
200	application/json, PagedResultStatusComponentView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:read.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
itemsrequired	array of StatusComponentView
items[].createdAtrequired	string (date-time)
items[].description	string
items[].groupName	string
items[].namerequired	string
items[].publicIdrequired	string
items[].showUptimerequired	boolean
items[].sortOrderrequired	integer
items[].statusrequired	string
items[].updatedAtrequired	string (date-time)
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/msp/status-components?dir=asc&page=0&pageSize=0&q=<q>&sort=created' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/msp/status-components?dir=asc&page=0&pageSize=0&q=<q>&sort=created' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/status-components"
params = {
    "dir": "asc",
    "page": "0",
    "pageSize": "0",
    "q": "<q>",
    "sort": "created",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/msp/status-components?dir=asc&page=0&pageSize=0&q=<q>&sort=created", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/msp/status-components");
url.searchParams.set("dir", "asc");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");
url.searchParams.set("q", "<q>");
url.searchParams.set("sort", "created");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/msp/status-components?dir=asc&page=0&pageSize=0&q=<q>&sort=created");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/msp/status-components

POSTincident:managemsp facemsp

Source: [object Object]

Create msp status component

Request body

Required, sent as application/json.

Field	Type	Description
description	string or null
groupName	string or null
name	string or null
showUptime	boolean or null
sortOrder	integer or null
status	string or null

Responses

Status	Body	Description
201	application/json, StatusComponentView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches.
409	application/problem+json, ProblemDetails	A component with that name already exists.
500	application/problem+json, ProblemDetails	Could not save the status component.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

201 response body

Field	Type	Description
createdAtrequired	string (date-time)
description	string
groupName	string
namerequired	string
publicIdrequired	string
showUptimerequired	boolean
sortOrderrequired	integer
statusrequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/msp/status-components' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "description": "string",
  "groupName": "string",
  "name": "string",
  "showUptime": false,
  "sortOrder": 0,
  "status": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "description": "string",
  "groupName": "string",
  "name": "string",
  "showUptime": false,
  "sortOrder": 0,
  "status": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/msp/status-components' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/msp/status-components"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "description": "string",
    "groupName": "string",
    "name": "string",
    "showUptime": False,
    "sortOrder": 0,
    "status": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "description": "string",
  "groupName": "string",
  "name": "string",
  "showUptime": false,
  "sortOrder": 0,
  "status": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/msp/status-components", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/status-components";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "description": "string",
    "groupName": "string",
    "name": "string",
    "showUptime": false,
    "sortOrder": 0,
    "status": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "description": "string",
  "groupName": "string",
  "name": "string",
  "showUptime": false,
  "sortOrder": 0,
  "status": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/msp/status-components");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/msp/status-components/{componentId}

GETincident:readmsp facemspIdempotent

Source: [object Object]

Get msp status component

Parameters

Name	In	Type	Required	Description
componentId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, StatusComponentView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the status component.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
createdAtrequired	string (date-time)
description	string
groupName	string
namerequired	string
publicIdrequired	string
showUptimerequired	boolean
sortOrderrequired	integer
statusrequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/msp/status-components/<componentId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/msp/status-components/<componentId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/status-components/<componentId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/msp/status-components/<componentId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/status-components/<componentId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/msp/status-components/<componentId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/msp/status-components/{componentId}

PATCHincident:managemsp facemspIdempotent

Source: [object Object]

Patch msp status component

Parameters

Name	In	Type	Required	Description
componentId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
description	string or null
groupName	string or null
name	string or null
showUptime	boolean or null
sortOrder	integer or null
status	string or null

Responses

Status	Body	Description
200	application/json, StatusComponentView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	A component with that name already exists.
500	application/problem+json, ProblemDetails	Could not read the status component.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
createdAtrequired	string (date-time)
description	string
groupName	string
namerequired	string
publicIdrequired	string
showUptimerequired	boolean
sortOrderrequired	integer
statusrequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PATCH 'https://depot.example.com/api/v1/msp/status-components/<componentId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "description": "string",
  "groupName": "string",
  "name": "string",
  "showUptime": false,
  "sortOrder": 0,
  "status": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "description": "string",
  "groupName": "string",
  "name": "string",
  "showUptime": false,
  "sortOrder": 0,
  "status": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/msp/status-components/<componentId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/status-components/<componentId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "description": "string",
    "groupName": "string",
    "name": "string",
    "showUptime": False,
    "sortOrder": 0,
    "status": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "description": "string",
  "groupName": "string",
  "name": "string",
  "showUptime": false,
  "sortOrder": 0,
  "status": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/msp/status-components/<componentId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/status-components/<componentId>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "description": "string",
    "groupName": "string",
    "name": "string",
    "showUptime": false,
    "sortOrder": 0,
    "status": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "description": "string",
  "groupName": "string",
  "name": "string",
  "showUptime": false,
  "sortOrder": 0,
  "status": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/msp/status-components/<componentId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/v1/msp/status-components/{componentId}

DELETEincident:managemsp facemspIdempotent

Source: [object Object]

deleteMspStatusComponent removes a component outright, and its impacts with it.

A hard delete for statuscomponents.go’s reason: a component is configuration rather than evidence.

Parameters

Name	In	Type	Required	Description
componentId	path	string	Yes	A uuid.

Responses

Status	Body	Description
204	None	Success, with no body.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the status component.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/msp/status-components/<componentId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/msp/status-components/<componentId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/status-components/<componentId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/msp/status-components/<componentId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/status-components/<componentId>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/msp/status-components/<componentId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/msp/status-page

GETstatuspage:managemsp facemspIdempotent

Source: [object Object]

getMspOwnStatusPage answers the settings screen.

A DEPOT WITH NO SAVED ROW ANSWERS 200 AND A DISABLED PAGE, never 404. The store says so at the seam - GetMspStatusPage returns a zero value rather than ErrNotFound - because “never configured” and “switched off” are the same 404 to a visitor, and the settings screen wants a form either way.

Responses

Status	Body	Description
200	application/json, MspOwnStatusPageView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold statuspage:manage.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
createdAt	string (date-time)
enabledrequired	boolean
pageTitlerequired	string
updatedAt	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/msp/status-page' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/msp/status-page' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/status-page"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/msp/status-page", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/status-page";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/msp/status-page");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/msp/status-page

PUTstatuspage:managemsp facemspIdempotent

Source: [object Object]

putMspOwnStatusPage writes the practice’s own page settings.

THERE IS NO “a page needs an address before it can be turned on” REFUSAL here, unlike the tenant route, and its absence is the point rather than an omission: that check exists because a tenant page with no slug is a page nothing can reach, which reads on the screen as “it is on and it does not work”. The MSP’s page is reached at /status on the MSP host whether or not anybody has typed a title, so enabling it always produces a working page. An empty title is rendered from the organisation name and then from a default, which is the statuspage package’s fallback and not this route’s to duplicate.

Request body

Required, sent as application/json.

Field	Type	Description
enabled	boolean or null
pageTitle	string or null

Responses

Status	Body	Description
200	application/json, MspOwnStatusPageView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold statuspage:manage.
404	application/problem+json, ProblemDetails	No resource matches.
500	application/problem+json, ProblemDetails	Could not save the status page settings.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
createdAt	string (date-time)
enabledrequired	boolean
pageTitlerequired	string
updatedAt	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/msp/status-page' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "enabled": false,
  "pageTitle": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "enabled": false,
  "pageTitle": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/msp/status-page' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/status-page"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "enabled": False,
    "pageTitle": "string",
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "enabled": false,
  "pageTitle": "string"
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/msp/status-page", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/status-page";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "enabled": false,
    "pageTitle": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "enabled": false,
  "pageTitle": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/msp/status-page");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/msp/status-pages

GETstatuspage:managemsp facemspIdempotent

Source: [object Object]

listMspStatusPages answers the estate screen: one row per client, with the page switch and the address.

A CLIENT WITH NO ROW STILL APPEARS, disabled and with no slug. Never having turned a page on is the ordinary state, and a roster that showed only the clients with rows would be a list an operator could not use to find the customer they came to switch on.

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold statuspage:manage.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/msp/status-pages' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/msp/status-pages' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/status-pages"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/msp/status-pages", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/status-pages";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/msp/status-pages");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/msp/status-pages/{clientId}

GETstatuspage:managemsp facemspIdempotent

Source: [object Object]

Get msp status page

Parameters

Name	In	Type	Required	Description
clientId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, MspStatusPageRow	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold statuspage:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the client.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
clientNamerequired	string
clientPublicIdrequired	string
createdAt	string (date-time)
enabledrequired	boolean
pageTitlerequired	string
slugrequired	string
updatedAt	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/msp/status-pages/<clientId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/msp/status-pages/<clientId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/status-pages/<clientId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/msp/status-pages/<clientId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/status-pages/<clientId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/msp/status-pages/<clientId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/msp/status-pages/{clientId}

PUTstatuspage:managemsp facemspIdempotent

Source: [object Object]

putMspStatusPage writes one client’s page settings from the estate screen.

It is the SAME merge and the SAME slug rules as the tenant route, deliberately sharing statusPageRequest and slugPattern rather than restating them: two writers that disagreed about what a slug is would be two ways to publish a page under an address the resolver cannot find.

Parameters

Name	In	Type	Required	Description
clientId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
enabled	boolean or null
generaterequired	boolean
pageTitle	string or null
slug	string or null

Responses

Status	Body	Description
200	application/json, MspStatusPageRow	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold statuspage:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	That status page address is already taken.
500	application/problem+json, ProblemDetails	Could not read the client.
503	application/problem+json, ProblemDetails	MSP-wide incidents are not available on this Depot.

200 response body

Field	Type	Description
clientNamerequired	string
clientPublicIdrequired	string
createdAt	string (date-time)
enabledrequired	boolean
pageTitlerequired	string
slugrequired	string
updatedAt	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/msp/status-pages/<clientId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "enabled": false,
  "generate": false,
  "pageTitle": "string",
  "slug": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "enabled": false,
  "generate": false,
  "pageTitle": "string",
  "slug": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/msp/status-pages/<clientId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/msp/status-pages/<clientId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "enabled": False,
    "generate": False,
    "pageTitle": "string",
    "slug": "string",
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "enabled": false,
  "generate": false,
  "pageTitle": "string",
  "slug": "string"
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/msp/status-pages/<clientId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/msp/status-pages/<clientId>";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "enabled": false,
    "generate": false,
    "pageTitle": "string",
    "slug": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "enabled": false,
  "generate": false,
  "pageTitle": "string",
  "slug": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/msp/status-pages/<clientId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());