# Incidents

***

## Endpoints

| Method   | Path                       | Permission         | Description                                        |
| -------- | -------------------------- | ------------------ | -------------------------------------------------- |
| `GET`    | `/api/incidents`           | `incidents:read`   | List incidents with filters                        |
| `GET`    | `/api/incidents/:id`       | `incidents:read`   | Get incident by ID                                 |
| `POST`   | `/api/incidents`           | `incidents:write`  | Create incident                                    |
| `PUT`    | `/api/incidents/:id`       | `incidents:write`  | Update incident (status, assignee, notes)          |
| `DELETE` | `/api/incidents/:id`       | `incidents:delete` | Delete incident                                    |
| `POST`   | `/api/incidents/correlate` | `incidents:read`   | AI-powered incident correlation (Anthropic Claude) |

***

## GET /api/incidents

List incidents with optional filters.

**Query parameters:**

| Parameter          | Type    | Description                               |
| ------------------ | ------- | ----------------------------------------- |
| `severity`         | string  | `critical` \| `high` \| `medium` \| `low` |
| `status`           | string  | `open` \| `in_progress` \| `resolved`     |
| `assetId`          | string  | Filter to a specific asset                |
| `from`             | ISO8601 | Detected at — start of range              |
| `to`               | ISO8601 | Detected at — end of range                |
| `page`, `pageSize` | number  | Pagination                                |

**Response (200):**

```json
{
  "data": [
    {
      "id": "uuid",
      "monitorId": "uuid",
      "assetId": "uuid",
      "productId": "lakehouse-uuid",
      "severity": "high",
      "status": "open",
      "message": "Record count dropped 35% from baseline",
      "metricValue": 8200,
      "thresholdValue": 10000,
      "detectedAt": "2026-03-24T09:15:00Z",
      "resolvedAt": null,
      "assigneeOid": null,
      "createdAt": "2026-03-24T09:15:00Z"
    }
  ]
}
```

***

## PUT /api/incidents/:id

Update an incident's status, assignee, or notes.

**Request:**

```json
{
  "status": "in_progress",
  "assigneeOid": "entra-user-oid",
  "notes": "Investigating upstream pipeline issue"
}
```

**Response (200):** Updated incident object.

***

## POST /api/incidents/correlate

Run AI-powered correlation analysis on a set of incidents using Anthropic Claude.

**Request:**

```json
{
  "incidentIds": ["uuid-1", "uuid-2", "uuid-3"]
}
```

**Minimum:** 2 incident IDs required.

**Response (200):**

```json
{
  "data": {
    "groups": [
      {
        "title": "Upstream pipeline failure affecting Sales Analytics",
        "confidence": "high",
        "incidents": ["uuid-1", "uuid-2"],
        "analysis": {
          "whyRelated": "Both incidents detected within 15 minutes on related tables",
          "rootCause": "The upstream ETL pipeline failed at 2:00 AM, causing downstream tables to not refresh",
          "recommendedAction": "Check pipeline logs and restart the ETL job. Verify data after recovery."
        }
      },
      {
        "title": "Unrelated completeness issue on customers table",
        "confidence": "high",
        "incidents": ["uuid-3"],
        "analysis": {
          "whyRelated": "Only one incident in this group",
          "rootCause": "Source system stopped populating the email column",
          "recommendedAction": "Check source system for email capture issues"
        }
      }
    ]
  }
}
```

**Confidence values:** `high` | `medium` | `low`

**Notes:**

* This operation does not modify any data — it only reads incidents and their metric history
* This endpoint requires `incidents:read` only — it does not modify any data


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://fabric-docs.telm.ai/api-reference/incidents.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.