Overview
Handle all operations related to incident management within Coralogix. Identify, manage, and resolve incidents efficiently through automated workflows and team collaboration.
Find out more about incident management in our documentation.
Authentication and permissions
To use the Incidents service API you need to create a personal or team API key. It's recommended to use permission presets, as they are automatically updated with all relevant permissions. Alternatively, you can manually add the following individual permissions.
| Presets | Permission | Description |
|---|---|---|
| Incidents | incidents:acknowledge | Access to incidents operations |
incidents:assign | Access to incidents operations | |
incidents:close | Access to incidents operations | |
incidents:read | Grants access to read incidents |
Common error response codes
| Status Code | Description |
|---|---|
400 Bad Request | Response code 400 |
401 Unauthorized | Response code 401 |
500 Internal Server Error | Response code 500 |
Protocol documentation
ListIncidents
ListIncidentsRequest
| Field | Type | Label | Description |
|---|---|---|---|
| filter | IncidentQueryFilter | Filter for listing incidents. | |
| pagination | PaginationRequest | Pagination details. | |
| order_bys | OrderBy | repeated | Ordering options for listing incidents. |
ListIncidentsResponse
| Field | Type | Label | Description |
|---|---|---|---|
| incidents | Incident | repeated | List of incidents. |
| pagination | PaginationResponse | Pagination details. |
ListIncidentAggregations
ListIncidentAggregationsRequest
| Field | Type | Label | Description |
|---|---|---|---|
| filter | IncidentQueryFilter | Filter for aggregations. | |
| group_bys | GroupBy | repeated | Grouping options for aggregations. |
| pagination | PaginationRequest | Pagination details. |
ListIncidentAggregationsResponse
| Field | Type | Label | Description |
|---|---|---|---|
| incident_aggs | IncidentAggregation | repeated | Aggregated incident data. |
| pagination | PaginationResponse | Pagination details. |
GetIncident
GetIncidentRequest
| Field | Type | Label | Description |
|---|---|---|---|
| id | google.protobuf.StringValue | ID of the incident to retrieve. |
GetIncidentResponse
| Field | Type | Label | Description |
|---|---|---|---|
| incident | Incident | Retrieved incident. |
GetIncidentEvents
GetIncidentEventsRequest
| Field | Type | Label | Description |
|---|---|---|---|
| incident_id | google.protobuf.StringValue | ID of the incident to get events for. |
GetIncidentEventsResponse
| Field | Type | Label | Description |
|---|---|---|---|
| incident_events | IncidentEvent | repeated | Events associated with the incident. |
BatchGetIncident
BatchGetIncidentRequest
| Field | Type | Label | Description |
|---|---|---|---|
| ids | google.protobuf.StringValue | repeated | IDs of incidents to be retrieved in batch. |
BatchGetIncidentResponse
| Field | Type | Label | Description |
|---|---|---|---|
| incidents | BatchGetIncidentResponse.IncidentsEntry | repeated | Retrieved incidents in batch. |
| not_found_ids | google.protobuf.StringValue | repeated | IDs of incidents not found. |
BatchGetIncidentResponse.IncidentsEntry
| Field | Type | Label | Description |
|---|---|---|---|
| key | string | Incident key. | |
| value | Incident | Retrieved incident. |
AssignIncidents
AssignIncidentsRequest
| Field | Type | Label | Description |
|---|---|---|---|
| incident_ids | google.protobuf.StringValue | repeated | IDs of incidents to be assigned. |
| assigned_to | UserDetails | Details of the user to whom incidents are to be assigned. |
AssignIncidentsResponse
| Field | Type | Label | Description |
|---|---|---|---|
| incidents | Incident | repeated | Assigned incidents. |
UnassignIncidents
UnassignIncidentsRequest
| Field | Type | Label | Description |
|---|---|---|---|
| incident_ids | google.protobuf.StringValue | repeated | IDs of incidents to be unassigned. |
UnassignIncidentsResponse
| Field | Type | Label | Description |
|---|---|---|---|
| incidents | Incident | repeated | Unassigned incidents. |
AcknowledgeIncidents
AcknowledgeIncidentsRequest
| Field | Type | Label | Description |
|---|---|---|---|
| incident_ids | google.protobuf.StringValue | repeated | IDs of incidents to be acknowledged. |
AcknowledgeIncidentsResponse
| Field | Type | Label | Description |
|---|---|---|---|
| incidents | Incident | repeated | Acknowledged incidents. |
CloseIncidents
CloseIncidentsRequest
| Field | Type | Label | Description |
|---|---|---|---|
| incident_ids | google.protobuf.StringValue | repeated | IDs of incidents to be closed. |
CloseIncidentsResponse
| Field | Type | Label | Description |
|---|---|---|---|
| incidents | Incident | repeated | Closed incidents. |
DeleteIncidents
DeleteIncidentRequest
| Field | Type | Label | Description |
|---|---|---|---|
| id | google.protobuf.StringValue | ID of the incident to be deleted. |
ResolveIncidents
ResolveIncidentsRequest
| Field | Type | Label | Description |
|---|---|---|---|
| incident_ids | google.protobuf.StringValue | repeated | IDs of incidents to be resolved. |
ResolveIncidentsResponse
| Field | Type | Label | Description |
|---|---|---|---|
| incidents | Incident | repeated | Resolved incidents. |
PaginationRequest
PaginationRequest
| Field | Type | Label | Description |
|---|---|---|---|
| page_size | google.protobuf.UInt32Value | Number of items per page. | |
| page_token | google.protobuf.StringValue | Token for the next page. |
PaginationResponse
| Field | Type | Label | Description |
|---|---|---|---|
| total_size | google.protobuf.UInt32Value | Total number of items. | |
| next_page_token | google.protobuf.StringValue | Token for the next page. |
AuditLogDescription
| Field | Type | Label | Description |
|---|---|---|---|
| description | string | optional | Description for audit logging. |
ContextualLabels
| Field | Type | Label | Description |
|---|---|---|---|
| field_name | google.protobuf.StringValue | Name of the contextual label field. | |
| field_value | google.protobuf.StringValue | Value of the contextual label. |
GroupByValues
| Field | Type | Label | Description |
|---|---|---|---|
| incident_field | IncidentFieldOneOf | Field to group incidents by. | |
| contextual_labels | ContextualLabels | Contextual labels for grouping incidents. |
Incident
The incident represents an unexpected or disruptive event within your system. The definition below outlines the essential attributes associated with managing and documenting such incidents in Coralogix. Here's a detailed description of the key components:
| Field | Type | Label | Description |
|---|---|---|---|
| id | google.protobuf.StringValue | Unique identifier for the incident. | |
| name | google.protobuf.StringValue | Name of the incident. | |
| state | IncidentState | Current state of the incident. | |
| status | IncidentStatus | Current status of the incident. | |
| assignments | Assignment | repeated | List of assignments for the incident. |
| description | google.protobuf.StringValue | Description of the incident. | |
| severity | IncidentSeverity | Severity level of the incident. | |
| contextual_labels | Incident.ContextualLabelsEntry | repeated | Contextual labels associated with the incident. |
| display_labels | Incident.DisplayLabelsEntry | repeated | Display labels associated with the incident. |
| events | IncidentEvent | repeated | List of events related to the incident. |
| created_at | google.protobuf.Timestamp | Timestamp when the incident was created. | |
| closed_at | google.protobuf.Timestamp | Timestamp when the incident was closed. | |
| last_state_update_time | google.protobuf.Timestamp | Timestamp of the last state update for the incident. | |
| last_state_update_key | google.protobuf.StringValue | Key associated with the last event that caused a state change in the incident. | |
| is_muted | google.protobuf.BoolValue | Indicates whether the incident is muted or suppressed. |
Incident.ContextualLabelsEntry
| Field | Type | Label | Description |
|---|---|---|---|
| key | string | Key of the contextual label. | |
| value | string | Value of the contextual label. |
Incident.DisplayLabelsEntry
| Field | Type | Label | Description |
|---|---|---|---|
| key | string | Key of the display label. | |
| value | string | Value of the display label. |
IncidentAggregation
Incident Aggregation is specifically used for grouping and summarizing incidents based on certain criteria. This aggregation seems to provide a consolidated view of multiple incidents, offering insights into various aspects of their states, statuses, severities, assignments, and other relevant details.
| Field | Type | Label | Description |
|---|---|---|---|
| group_bys_value | GroupByValues | repeated | Group by fields and values for the aggregation. |
| agg_state_count | IncidentStateCount | repeated | Count of incidents for each state in the aggregation. |
| agg_status_count | IncidentStatusCount | repeated | Count of incidents for each status in the aggregation. |
| agg_severity_count | IncidentSeverityCount | repeated | Count of incidents for each severity in the aggregation. |
| agg_assignments_count | IncidentAssignmentCount | repeated | Count of incidents for each assignment in the aggregation. |
| first_created_at | google.protobuf.Timestamp | Timestamp of the first incident created in the aggregation. | |
| last_closed_at | google.protobuf.Timestamp | Timestamp of the last incident closed in the aggregation. | |
| all_values_count | google.protobuf.UInt32Value | Total count of incidents in the aggregation. | |
| list_incidents_id | google.protobuf.StringValue | repeated | List of incident IDs in the aggregation. |
| last_state_update_time | google.protobuf.Timestamp | Timestamp of the last state update in the aggregation. |
IncidentAssignmentCount
| Field | Type | Label | Description |
|---|---|---|---|
| assigned_to | UserDetails | Details of the user to whom incidents are assigned. | |
| count | google.protobuf.UInt32Value | Count of incidents assigned to the user. |
IncidentFieldOneOf
| Field | Type | Label | Description |
|---|---|---|---|
| id | google.protobuf.StringValue | Unique identifier for the incident field. | |
| severity | IncidentSeverity | Severity level of the incident field. | |
| name | google.protobuf.StringValue | Name of the incident field. | |
| created_at | google.protobuf.Timestamp | Timestamp when the incident field was created. | |
| closed_at | google.protobuf.Timestamp | Timestamp when the incident field was closed. | |
| state | IncidentState | State of the incident field. | |
| status | IncidentStatus | Status of the incident field. | |
| last_state_update_time | google.protobuf.Timestamp | Timestamp of the last state update for the incident field. | |
| application_name | google.protobuf.StringValue | Application name associated with the incident field. | |
| subsystem_name | google.protobuf.StringValue | Subsystem name associated with the incident field. |
IncidentSeverityCount
| Field | Type | Label | Description |
|---|---|---|---|
| severity | IncidentSeverity | Severity level. | |
| count | google.protobuf.UInt32Value | Count of incidents for the severity level. |
IncidentStateCount
| Field | Type | Label | Description |
|---|---|---|---|
| state | IncidentState | State of the incident. | |
| count | google.protobuf.UInt32Value | Count of incidents for the state. |
IncidentStatusCount
| Field | Type | Label | Description |
|---|---|---|---|
| status | IncidentStatus | Status of the incident. | |
| count | google.protobuf.UInt32Value | Count of incidents for the status. |
IncidentFields
| Name | Number | Description |
|---|---|---|
| INCIDENTS_FIELDS_UNSPECIFIED | 0 | Unspecified incident field. |
| INCIDENTS_FIELDS_ID | 1 | Incident ID. |
| INCIDENTS_FIELDS_SEVERITY | 2 | Incident severity. |
| INCIDENTS_FIELDS_NAME | 3 | Incident name. |
| INCIDENTS_FIELDS_CREATED_TIME | 4 | Timestamp when the incident was created. |
| INCIDENTS_FIELDS_CLOSED_TIME | 5 | Timestamp when the incident was closed. |
| INCIDENTS_FIELDS_STATE | 6 | Current state of the incident. |
| INCIDENTS_FIELDS_STATUS | 7 | Current status of the incident. |
| INCIDENTS_FIELDS_LAST_STATE_UPDATE_TIME | 8 | Timestamp of the last state update for the incident. |
| INCIDENTS_FIELDS_APPLICATION_NAME | 9 | Application name associated with the incident. |
| INCIDENTS_FIELDS_SUBSYSTEM_NAME | 10 | Subsystem name associated with the incident. |
incident_severity.proto
IncidentSeverity
| Name | Number | Description |
|---|---|---|
| INCIDENT_SEVERITY_UNSPECIFIED | 0 | Unspecified incident severity. |
| INCIDENT_SEVERITY_INFO | 1 | Informational incident severity. |
| INCIDENT_SEVERITY_WARNING | 2 | Warning incident severity. |
| INCIDENT_SEVERITY_ERROR | 3 | Error incident severity. |
| INCIDENT_SEVERITY_CRITICAL | 4 | Critical incident severity. |
incident_status.proto
IncidentStatus
| Name | Number | Description |
|---|---|---|
| INCIDENT_STATUS_UNSPECIFIED | 0 | Unspecified incident status. |
| INCIDENT_STATUS_TRIGGERED | 1 | Incident is triggered. |
| INCIDENT_STATUS_ACKNOWLEDGED | 2 | Incident is acknowledged. |
| INCIDENT_STATUS_RESOLVED | 3 | Incident is resolved. |
assignee.proto
Assignment
| Field | Type | Label | Description |
|---|---|---|---|
| assigned_to | UserDetails | Details of the user to whom the incident is assigned. | |
| assigned_by | UserDetails | Details of the user who assigned the incident. |
UserDetails
| Field | Type | Label | Description |
|---|---|---|---|
| user_id | google.protobuf.StringValue | ID of the user. |
incident_event/incident_event_unassign.proto
IncidentEventUnassign
This represents an event where an incident is unassigned.
incident_event/incident_event_acknowledge.proto
IncidentEventAcknowledge
| Field | Type | Label | Description |
|---|---|---|---|
| acknowledged_by | UserDetails | Details of the user who acknowledged the incident. |
incident_event/incident_event_type.proto
IncidentEventType
| Name | Number | Description |
|---|---|---|
| INCIDENT_EVENT_TYPE_UNSPECIFIED | 0 | Unspecified incident event type. |
| INCIDENT_EVENT_TYPE_UPSERT_STATE | 2 | Incident event for upserting state. |
| INCIDENT_EVENT_TYPE_OPEN | 4 | Incident event for opening an incident. |
| INCIDENT_EVENT_TYPE_CLOSE | 5 | Incident event for closing an incident. |
| INCIDENT_EVENT_TYPE_SNOOZE_INDICATOR | 6 | Incident event for snooze indicator. |
| INCIDENT_EVENT_TYPE_ASSIGN | 7 | Incident event for assigning an incident. |
| INCIDENT_EVENT_TYPE_UNASSIGN | 9 | Incident event for unassigning an incident. |
| INCIDENT_EVENT_TYPE_ACKNOWLEDGE | 8 | Incident event for acknowledging an incident. |
incident_event/incident_event_assign.proto
IncidentEventAssign
| Field | Type | Label | Description |
|---|---|---|---|
| assignment | Assignment | Details of the assignment event. |
incident_event/incident_event_originator_operational.proto
IncidentEventOriginatorOperational
| Field | Type | Label | Description |
|---|---|---|---|
| system_name | google.protobuf.StringValue | Name of the operational system originating the event. |
incident_event/incident_event_originator_administrative.proto
IncidentEventOriginatorAdministrative
| Field | Type | Label | Description |
|---|---|---|---|
| user_id | google.protobuf.StringValue | ID of the administrative user originating the event. |
incident_event/incident_event_originator_type.proto
OriginatorType
| Name | Number | Description |
|---|---|---|
| ORIGINATOR_TYPE_UNSPECIFIED | 0 | Unspecified originator type. |
| ORIGINATOR_TYPE_OPERATIONAL | 1 | Operational originator type. |
| ORIGINATOR_TYPE_ADMINISTRATIVE | 2 | Administrative originator type. |
incident_event/incident_event_snooze_indicator.proto
IncidentEventSnoozeIndicator
| Field | Type | Label | Description |
|---|---|---|---|
| start_time | google.protobuf.Timestamp | Start time of the snooze period. | |
| duration_minutes | google.protobuf.Int32Value | Duration of the snooze period in minutes. | |
| user_id | google.protobuf.StringValue | ID of the user who initiated the snooze. |
incident_event/incident_event.proto
IncidentEvent
An incident event typically refers to a specific occurrence or action related to the management and lifecycle of an incident within your system. This structured definition includes various fields to capture details about the event.
| Field | Type | Label | Description |
|---|---|---|---|
| id | google.protobuf.StringValue | Unique identifier for the incident event. | |
| incident_event_type | IncidentEventType | Type of the incident event. | |
| snooze_indicator | IncidentEventSnoozeIndicator | Information related to snooze indicator event. | |
| assignment | IncidentEventAssign | Information related to assignment event. | |
| unassign | IncidentEventUnassign | Information related to unassignment event. | |
| upsert_state | IncidentEventUpsertState | Information related to upsert state event. | |
| acknowledge | IncidentEventAcknowledge | Information related to acknowledgment event. | |
| close | IncidentEventClose | Information related to closure event. | |
| originator_type | OriginatorType | Type of the originator (administrative or operational) for the incident event. | |
| administrative_event | IncidentEventOriginatorAdministrative | Details of the administrative user who triggered the event. | |
| operational_event | IncidentEventOriginatorOperational | Details of the operational system that triggered the event. |
incident_event/incident_event_upsert_state.proto
IncidentEventUpsertState
| Field | Type | Label | Description |
|---|---|---|---|
| state_type | UpsertIncidentStateType | Type of upsert state event. | |
| payload | UpsertIncidentStatePayload | Payload associated with the upsert state event. | |
| is_muted | google.protobuf.BoolValue | Indicates whether the incident is muted during the upsert state event. |
UpsertIncidentStatePayload
| Field | Type | Label | Description |
|---|---|---|---|
| cx_event_key | google.protobuf.StringValue | Coralogix event key associated with the incident. |
UpsertIncidentStateType
| Name | Number | Description |
|---|---|---|
| UPSERT_INCIDENT_STATE_TYPE_UNSPECIFIED | 0 | Unspecified upsert incident state type. |
| UPSERT_INCIDENT_STATE_TYPE_TRIGGERED | 1 | Upsert state for triggered incidents. |
| UPSERT_INCIDENT_STATE_TYPE_RESOLVED | 2 | Upsert state for resolved incidents. |
incident_event/incident_event_close.proto
IncidentEventClose
| Field | Type | Label | Description |
|---|---|---|---|
| closed_by | UserDetails | Details of the user who closed the incident. |
incident_query_filter.proto
ContextualLabelValues
| Field | Type | Label | Description |
|---|---|---|---|
| contextual_label_values | google.protobuf.StringValue | repeated | List of contextual label values. |
IncidentQueryFilter
Incident Query Filter is used for specifying criteria when querying or filtering incidents within a your system. This definition includes various fields that can be used to filter incidents based on different attributes.
| Field | Type | Label | Description |
|---|---|---|---|
| assignee | google.protobuf.StringValue | repeated | List of assignee user IDs. |
| status | IncidentStatus | repeated | List of incident statuses. |
| state | IncidentState | repeated | List of incident states. |
| severity | IncidentSeverity | repeated | List of incident severities. |
| contextual_labels | IncidentQueryFilter.ContextualLabelsEntry | repeated | List of contextual labels and their values. |
| search_query | IncidentSearchQuery | Search query for incidents. | |
| application_name | google.protobuf.StringValue | repeated | List of application names. |
| subsystem_name | google.protobuf.StringValue | repeated | List of subsystem names. |
| is_muted | google.protobuf.BoolValue | Indicates whether incidents are muted. | |
| created_at_range | TimeRange | Filters all incidents created at the given time range | |
| incident_duration_range | TimeRange | Filters all incidents open (alive) at the given time range |
IncidentQueryFilter.TimeRange
| Field | Type | Label | Description |
|---|---|---|---|
| start_time | google.protobuf.Timestamp | Start time for filtering incidents. | |
| end_time | google.protobuf.Timestamp | End time for filtering incidents. |
IncidentQueryFilter.ContextualLabelsEntry
| Field | Type | Label | Description |
|---|---|---|---|
| key | string | Key of the contextual label. | |
| value | ContextualLabelValues | List of values for the contextual label. |
incident_state.proto
IncidentState
| Name | Number | Description |
|---|---|---|
| INCIDENT_STATE_UNSPECIFIED | 0 | Unspecified incident state. |
| INCIDENT_STATE_TRIGGERED | 1 | Incident is triggered. |
| INCIDENT_STATE_RESOLVED | 2 | Incident is resolved. |
incident_query.proto
GroupBy
| Field | Type | Label | Description |
|---|---|---|---|
| incident_field | IncidentFields | Field to group incidents by. | |
| contextual_label | google.protobuf.StringValue | Contextual label to group incidents by. | |
| order_by_direction | OrderByDirection | Direction for ordering the grouped incidents. |
IncidentSearchQuery
| Field | Type | Label | Description |
|---|---|---|---|
| query | google.protobuf.StringValue | Search query string. | |
| incident_field | IncidentFields | Field to search incidents by. | |
| contextual_label | google.protobuf.StringValue | Contextual label to search incidents by. |
OrderBy
| Field | Type | Label | Description |
|---|---|---|---|
| incident_field | IncidentFields | Field for ordering incidents. | |
| contextual_label | google.protobuf.StringValue | Contextual label for ordering incidents. | |
| direction | OrderByDirection | Direction for ordering incidents. |
OrderByDirection
| Name | Number | Description |
|---|---|---|
| ORDER_BY_DIRECTION_UNSPECIFIED | 0 | Unspecified order direction. |
| ORDER_BY_DIRECTION_ASC | 1 | Ascending order. |
| ORDER_BY_DIRECTION_DESC | 2 | Descending order. |
OrderByFields
| Name | Number | Description |
|---|---|---|
| ORDER_BY_FIELDS_UNSPECIFIED | 0 | Unspecified order field. |
| ORDER_BY_FIELDS_ID | 1 | Order by incident ID. |
| ORDER_BY_FIELDS_SEVERITY | 2 | Order by incident severity. |
| ORDER_BY_FIELDS_NAME | 3 | Order by incident name. |
| ORDER_BY_FIELDS_CREATED_TIME | 4 | Order by incident creation time. |
| ORDER_BY_FIELDS_CLOSED_TIME | 5 | Order by incident closure time. |
ScopeDetails
| Field | Type | Label | Description |
|---|---|---|---|
| subsystem_name | google.protobuf.StringValue | Name of the subsystem. | |
| application_name | google.protobuf.StringValue | Name of the application. |