CLcloudzero
incidents

Get incident

Changed on

Returns a single incident. monitor_id is null when the monitor has been deleted.

get/v2/incidents/{incidentId}

Request

Path parameters

incidentIdstring required

The ID of the incident

Response

Successful Response

affected_resourcesobject[] required

Resources the analysis found driving the spend: czrn is the CloudZero resource name and pct its percent increase above its own baseline, null when it has no baseline

anomalous_daysobject required

Cost impact for each anomalous day, keyed by the day as an ISO 8601 date

attribution_tagsobject required

Ownership tags found on the affected resources, keyed by tag name, such as team or owner

cost_impactnumber required

Total cost impact: spend above the expected range, summed over the anomalous days

cost_typestring required

Cost type the monitor evaluated when it raised the incident

created_atstring date-time required

When the incident was created, as an ISO 8601 UTC timestamp

descriptionstring required

Full explanation of the incident's cause and impact, in Markdown, as the incident page in CloudZero shows it. An empty string when the analysis has not produced one

end_datestring date required

Most recent anomalous day, as an ISO 8601 date

incident_idstring required

Unique identifier for the incident

monitor_idstring nullable

The monitor that raised the incident; null if that monitor was deleted

monitor_namestring required

Name of the monitor that raised the incident

pct_above_baselinenumber nullable

Total actual spend over total expected spend across the anomalous days, as a percent; null when it cannot be computed

resolution_reason'intentional' | 'remediated' | 'self_resolved' | 'not_an_anomaly'
resolution_reason_detailstring nullable

Note recorded when the incident was resolved; null when none was given

spend_statusstring required

ongoing while spend is anomalous, or returned_to_baseline after two days without anomalous spend

start_datestring date required

First anomalous day, as an ISO 8601 date

statusstring required

Workflow status: active, investigating or resolved

summarystring nullable

Short description of the incident: one line of plain text, usually under 100 characters and never more than 250, with no Markdown or line breaks; suited to tables, chat messages and ticket titles. Null when the analysis has not produced one

titlestring required

Short headline for the incident, such as "EC2 spend up 64% in account 123456789012"

updated_atstring date-time required

When the incident was last updated, as an ISO 8601 UTC timestamp

Changes