Get incident

Returns a single incident by ID.

GET https://incidents.betterstack.com/api/v3/incidents/{incident_id}

URL parameters

incident_id

required string

The ID of the incident you want to get

Headers

Authorization

required string

Bearer $TOKEN

200

Returns the requested incident.

Response body

{
  "data": {
    "id": "25",
    "type": "incident",
    "attributes": {
      "name": "uptime homepage",
      "url": "https://uptime.betterstack.com/",
      "http_method": "get",
      "cause": "Status 404",
      "incident_group_id": null,
      "started_at": "2020-03-09T17:37:56.662Z",
      "acknowledged_at": null,
      "acknowledged_by": null,
      "resolved_at": null,
      "resolved_by": null,
      "status": "Started",
      "team_name": "Testing team",
      "response_content": "\n404 Not Found\n\nNot Found\nThe requested URL /fail was not found on this server.\n",
      "response_options": "{}",
      "regions": [
        "us",
        "eu",
        "as",
        "au"
      ],
      "response_url": null,
      "screenshot_url": null,
      "origin_url": null,
      "escalation_policy_id": null,
      "call": true,
      "sms": true,
      "email": true,
      "push": true,
      "critical_alert": false,
      "slack_channels": [
        "inc-20-03-09-uptime-homepage-not-found"
      ],
      "metadata": {
        "Request duration": [
          {
            "type": "String",
            "value": "0.036304"
          }
        ],
        "Response code": [
          {
            "type": "String",
            "value": "404"
          }
        ]
      }
    },
    "relationships": {
      "monitor": {
        "data": {
          "id": "2",
          "type": "monitor"
        }
      }
    }
  },
  "included": [
    {
      "id": "2",
      "type": "monitor",
      "attributes": {
        "url": "https://uptime.betterstack.com/",
        "pronounceable_name": "Uptime homepage",
        "auth_username": "",
        "auth_password": "",
        "monitor_type": "status",
        "monitor_group_id": null,
        "last_checked_at": "2024-05-29T15:53:40.000Z",
        "status": "paused",
        "policy_id": null,
        "required_keyword": null,
        "verify_ssl": true,
        "check_frequency": 30,
        "call": false,
        "sms": false,
        "email": true,
        "push": true,
        "team_wait": 180,
        "http_method": "get",
        "request_timeout": 30,
        "recovery_period": 180,
        "request_headers": [],
        "request_body": "",
        "follow_redirects": true,
        "remember_cookies": true,
        "created_at": "2020-02-28T19:30:09.956Z",
        "updated_at": "2020-11-23T09:08:20.817Z",
        "ssl_expiration": 14,
        "domain_expiration": null,
        "regions": [
          "us",
          "eu",
          "as",
          "au"
        ],
        "expected_status_codes": [],
        "port": null,
        "confirmation_period": 0,
        "paused_at": null,
        "paused": false,
        "maintenance_from": null,
        "maintenance_to": null,
        "maintenance_timezone": "Tokyo",
        "maintenance_days": [
          "mon",
          "tue",
          "wed",
          "thu",
          "fri",
          "sat",
          "sun"
        ],
        "playwright_script": "import { test, expect } from '@playwright/test';\r\n\r\ntest('has title', async ({ page }) => {\r\n  await page.goto('https://betterstack.com/')\r\n  await expect(page).toHaveTitle(/Better Stack/)\r\n});\r\n",
        "checks_version": "v3",
        "ip_version": null
      },
      "relationships": {
        "policy": {
          "data": null
        }
      }
    }
  ]
}

Response attributes

string

The ID of the incident.

type

string

Always incident.

attributes.name

string

The name of the incident.

attributes.url

string or null

The URL the monitor checked, null for incidents not raised by a URL check.

attributes.http_method

string or null

The HTTP method of the check, such as get.

attributes.cause

string or null

What caused the incident, such as Status 500.

attributes.incident_group_id

integer or null

The ID of the group of similar incidents this incident belongs to, null when it isn't grouped.

attributes.started_at

string or null

When the incident started, as an ISO 8601 date-time. null while the incident is Unconfirmed.

attributes.acknowledged_at

string or null

When the incident was acknowledged, null until then.

attributes.acknowledged_by

string or null

The name of whoever acknowledged the incident, such as a team member or API.

attributes.resolved_at

string or null

When the incident was resolved, null until then.

attributes.resolved_by

string or null

The name of whoever resolved the incident.

attributes.status

string

The current status: Started, Acknowledged, Validating while the check is passing again during the recovery period, Resolved, or Unconfirmed while other regions are still confirming the failure. Listing returns only confirmed incidents.

attributes.team_name

string

The team the incident belongs to.

attributes.response_content

string or null

The response body that triggered the incident, when it's shorter than 500 characters. Longer bodies are linked in response_url instead.

attributes.response_options

string or null

Metadata of the response that triggered the incident, as a JSON string.

attributes.regions

array or null

The regions that ran the failing check: us, eu, as, or au.

attributes.response_url

string or null

A link to the response body that triggered the incident, when it's 500 characters or longer.

attributes.screenshot_url

string or null

A screenshot taken when the incident started.

attributes.origin_url

string or null

A link to the alert in the third-party tool that raised the incident.

attributes.escalation_policy_id

integer or null

The ID of the escalation policy alerting for this incident, null when none is set.

attributes.call

boolean

Whether the on-call person is called.

attributes.sms

boolean

Whether the on-call person gets an SMS.

attributes.email

boolean

Whether the on-call person gets an e-mail.

attributes.push

boolean

Whether the on-call person gets a push notification.

attributes.critical_alert

boolean

Whether the push notification is a critical alert that ignores the mute switch and Do Not Disturb mode. Devices that don't support critical alerts get a regular push notification.

attributes.slack_channels

array

The names of the Slack channels created for this incident by channel-type Slack integrations. Empty when there are none.

attributes.metadata

object

The incident's metadata, mapping each key to an array of values. Most incidents have an Origin key naming where they came from, such as Monitor or Datadog integration.

attributes.metadata.*[].type

string

The type of the value: String, User, Team, Policy, Schedule, Endpoint, Source, SlackIntegration, LinearIntegration, JiraIntegration, MicrosoftTeamsWebhook, ZapierWebhook, NativeWebhook, or PagerDutyWebhook.

attributes.metadata.*[].value

string

The text of a String value.

attributes.metadata.*[].item_id

integer

The ID of the item a value of any other type references.

attributes.metadata.*[].name

string

The name of the referenced item.

attributes.metadata.*[].email

string

The e-mail of the referenced user, only when type is User.

attributes.shared

boolean

Present and true when listing incidents with a token for one team and another team escalated the incident to yours.

attributes.ssl_certificate_expires_at

string

When the SSL certificate expires, as an ISO 8601 date-time. Present only on SSL certificate expiration incidents.

attributes.domain_expires_at

string

When the domain expires, as an ISO 8601 date-time. Present only on domain expiration incidents.

relationships.monitor.data.id

string

The ID of the monitor that triggered the incident, with type monitor. Present only for monitor incidents.

relationships.heartbeat.data.id

string

The ID of the heartbeat that triggered the incident, with type heartbeat. Present only for heartbeat incidents.

relationships.webhook_integration.data.id

string

The ID of the integration that triggered the incident, with type webhook_integration. Also present for incidents raised by a dashboard alert.

included

array

The full monitor or heartbeat that triggered the incident, in the same shape the monitors and heartbeats APIs return. Present when getting a single incident.

Example cURL

Example

Copied!

curl --request GET \
  --url https://incidents.betterstack.com/api/v3/incidents/123456789 \
  --header "Authorization: Bearer $TOKEN"

List incidents

List incident timeline

Explore documentation

Get incident

Example cURL

Please accept cookies