---
title: "One incident with its recorded timeline"
method: GET
path: "/api/v1/incidents/{id}"
tags: ["Incidents"]
---

# One incident with its recorded timeline

`GET /api/v1/incidents/{id}`

## Request

- Base URL: `https://app.lastping.dev`
- URL: `https://app.lastping.dev/api/v1/incidents/{id}`
- Auth: API key in header `X-Api-Key`

What the run was doing, when the failure was declared, which alerts
went out and to whom, what was written back, and when it resolved —
as an ordered list of recorded events. Nothing is inferred; see
`IncidentEvent`.

## Response `200`

The incident and its events, oldest first.

- IncidentDetail: One incident with its recorded timeline.
  - `incident_id` integer, required
  - `check_id` string, uuid, required
  - `check_slug` string, required
  - `check_name` string, required
  - `cause` string, required
  - `opened_at` string, date-time, required
  - `closed_at` string, date-time, nullable, required
  - `detail` string: Omitted when empty.
  - `run_id` string, required: The run the incident is about, recorded when it opened. An empty string means no run was recorded (the monitor never sent `/start`, or the incident predates run tracking); the timeline then carries no `run_started`, `step` or `run_*` events, which is a fact about the record, not an anomaly.
  - `events` IncidentEvent[], required
    - `at` string, date-time, required
    - `kind` 'run_started' | 'step' | 'run_failed' | 'run_cancelled' | 'run_blocked' | 'incident_opened' | 'alert_delivered' | 'alert_failed' | 'alert_suppressed' | 'alert_pending' | 'note' | 'recovery_ping' | 'incident_resolved', required
    - `rid` string: `run_started` and `recovery_ping`. The run id the job chose; raw job input.
    - `title` string: `run_started` only. The body posted with `/start`, when one was; raw job output.
    - `seq` integer: `step` only.
    - `name` string: `step` only. The step name the job reported; raw job output.
    - `exit_code` integer: `run_failed` / `run_cancelled` / `run_blocked`, when the ping reported one.
    - `duration_ms` integer: Terminal run events and `recovery_ping`, when the run paired with its `/start`.
    - `body_excerpt` string: Terminal run events and `recovery_ping`. What the run printed; raw job output.
    - `cause` string: `incident_opened` only. Same vocabulary as `Incident.cause`.
    - `detail` string: `incident_opened` only. CI failure detail, when captured.
    - `event_type` string: `alert_*` only. The alert event type delivered: the alert sent when the incident opened (for example `down` or `fail`) or `recovery`, the all-clear sent when the incident closed.
    - `channel_id` string, uuid: `alert_*` only.
    - `channel_name` string: `alert_*` only. `(removed)` when the destination has since been deleted.
    - `attempts` integer: `alert_*` only. Delivery attempts made. The last error text is never exposed.
    - `author` 'agent' | 'user': `note` only.
    - `body` string: `note` only. The note's text.

## Other responses

- `400`: The id is not a positive integer.
- `401`: Missing or invalid API key.
- `404`: No such incident in this project.

---

[API](https://skmtc.dev/lastping/apis/lastping-management-api.md) · [All operations](https://skmtc.dev/lastping/apis/lastping-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lastping/apis/lastping-management-api/revisions/bbc6eda91c46?raw)