--- title: "Get incident" method: GET path: "/v2/incidents/{incidentId}" tags: ["incidents"] --- # Get incident `GET /v2/incidents/{incidentId}` ## Request - Base URL: `https://api.cloudzero.com` - URL: `https://api.cloudzero.com/v2/incidents/{incidentId}` - Auth: API key in header `Authorization` - TypeScript: (a function with typed inputs; its response is checked against the schema) Returns a single incident. `monitor_id` is null when the monitor has been deleted. ## Path parameters - `incidentId` string, required: The ID of the incident ## Response `200` Successful Response - Incident: An incident as the detail endpoint returns it. - `affected_resources` object[], required: Resources the analysis found driving the spend: `czrn` is the CloudZero resource name and `pct` its percent increase above its own baseline, null when it has no baseline - `anomalous_days` object, required: Cost impact for each anomalous day, keyed by the day as an ISO 8601 date - `attribution_tags` object, required: Ownership tags found on the affected resources, keyed by tag name, such as `team` or `owner` - `cost_impact` number, required: Total cost impact: spend above the expected range, summed over the anomalous days - `cost_type` string, required: Cost type the monitor evaluated when it raised the incident - `created_at` string, date-time, required: When the incident was created, as an ISO 8601 UTC timestamp - `description` string, required: Full explanation of the incident's cause and impact, in Markdown, as the incident page in CloudZero shows it. An empty string when the analysis has not produced one - `end_date` string, date, required: Most recent anomalous day, as an ISO 8601 date - `incident_id` string, required: Unique identifier for the incident - `monitor_id` string, nullable: The monitor that raised the incident; null if that monitor was deleted - `monitor_name` string, required: Name of the monitor that raised the incident - `pct_above_baseline` number, nullable: Total actual spend over total expected spend across the anomalous days, as a percent; null when it cannot be computed - `resolution_reason` 'intentional' | 'remediated' | 'self_resolved' | 'not_an_anomaly' - `resolution_reason_detail` string, nullable: Note recorded when the incident was resolved; null when none was given - `spend_status` string, required: `ongoing` while spend is anomalous, or `returned_to_baseline` after two days without anomalous spend - `start_date` string, date, required: First anomalous day, as an ISO 8601 date - `status` string, required: Workflow status: `active`, `investigating` or `resolved` - `summary` string, nullable: Short description of the incident: one line of plain text, usually under 100 characters and never more than 250, with no Markdown or line breaks; suited to tables, chat messages and ticket titles. Null when the analysis has not produced one - `title` string, required: Short headline for the incident, such as "EC2 spend up 64% in account 123456789012" - `updated_at` string, date-time, required: When the incident was last updated, as an ISO 8601 UTC timestamp ## Other responses - `401`: Unauthorized: the API key is missing or invalid (gateway `{"message": ...}` body), or the key carries no organization - `403`: Forbidden: the API key lacks the scope for this operation (gateway `{"message": ...}` body) - `404`: Not found: the resource does not exist or belongs to another organization - `422`: A parameter failed validation; `details` lists each field failure when present ## Changes - **2026-11-03** `56a692cf51b1`: 1 info - endpoint added [Operation history](https://skmtc.dev/cloudzero/apis/cloudzero-api-v2-resources/changes/v2/incidents/:incidentId/get.md) --- [API](https://skmtc.dev/cloudzero/apis/cloudzero-api-v2-resources.md) - [All operations](https://skmtc.dev/cloudzero/apis/cloudzero-api-v2-resources/llms.txt) - [OpenAPI document](https://skmtc.dev/cloudzero/apis/cloudzero-api-v2-resources/revisions/56a692cf51b1?raw)