---
title: "Change Incident State"
method: POST
path: "/v1/incidents/{incident-id}/state"
tags: ["Incidents"]
---

# Change Incident State

`POST /v1/incidents/{incident-id}/state`

## Request

- Base URL: `http://127.0.0.1:8000`
- URL: `http://127.0.0.1:8000/v1/incidents/{incident-id}/state`
- Auth: HTTP bearer

Change incident state. Moving to RESOLVED resolves all linked alarms, moving to CLOSED terminates them. CLOSED is terminal - no further changes are accepted. Moving to BLOCKED requires a comment.

## Path parameters

- `incident-id` integer, required

## Request body

- IncidentStateChange
  - `state` integer, required: New incident state: 0 open, 1 in progress, 2 blocked, 3 resolved, 4 closed.
  - `comment` string: Comment describing the change. Required when new state is 2 (blocked).

## Response `200`

Incident state changed.

- Incident: Full incident details
  - `id` integer: Unique incident identifier.
  - `state` integer: Incident state: 0 open, 1 in progress, 2 blocked, 3 resolved, 4 closed.
  - `stateName` string: Human-readable incident state name.
  - `title` string: Incident title (up to 255 characters).
  - `sourceObjectId` integer: ID of object the incident was created on.
  - `sourceObjectName` string: Name of the source object.
  - `assignedUserId` integer: ID of user the incident is assigned to, or 0 when unassigned.
  - `assignedUserName` string: Login name of assigned user. Unassigned incidents must be detected by testing assignedUserId for 0, not by matching on this name - user ID 0 resolves to the built-in "system" account.
  - `alarmCount` integer: Number of alarms linked to the incident.
  - `creationTime` string, date-time: Incident creation time.
  - `lastChangeTime` string, date-time: Time of last incident change.
  - `sourceAlarmId` integer: ID of alarm the incident was created from, or 0 if created manually.
  - `createdByUser` integer: ID of user who created the incident, or 0 when created by event processing rule.
  - `createdByUserName` string: Login name of creating user. Resolves to the built-in "system" account when the incident was created by an event processing rule.
  - `resolvedByUser` integer: ID of user who resolved the incident, or 0 if not resolved yet.
  - `resolvedByUserName` string: Login name of resolving user. Meaningful only when resolvedByUser is not 0.
  - `resolveTime` string, date-time, nullable: Time the incident was resolved, or null if not resolved yet.
  - `closedByUser` integer: ID of user who closed the incident, or 0 if not closed yet.
  - `closedByUserName` string: Login name of closing user. Meaningful only when closedByUser is not 0.
  - `closeTime` string, date-time, nullable: Time the incident was closed, or null if not closed yet.
  - `linkedAlarms` integer[]: IDs of alarms linked to the incident.
  - `comments` IncidentComment[]: Incident comments, oldest first.
    - `id` integer: Unique comment identifier.
    - `incidentId` integer: ID of incident the comment belongs to.
    - `userId` integer: ID of user who added the comment, or 0 for comments added by the server itself.
    - `userName` string: Login name of user who added the comment. Comments added by the server itself (AI analysis, event processing rules) carry user ID 0 and resolve to the built-in "system" account; use aiGenerated to identify AI-authored comments.
    - `creationTime` string, date-time: Comment creation time.
    - `text` string: Comment text.
    - `aiGenerated` boolean: True if the comment was generated by AI analysis.

## Other responses

- `400`: Invalid state value, or comment missing for BLOCKED state
- `401`: Unauthorized
- `403`: User does not have "Manage incidents" access to incident's source object
- `404`: Incident with given ID does not exist
- `409`: Incident is closed and cannot be modified

## Changes

- **2026-08-04** `71dbc43f5eda`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/netxms/apis/netxms-api/changes/v1/incidents/:incident-id/state/post.md)

---

[API](https://skmtc.dev/netxms/apis/netxms-api.md) - [All operations](https://skmtc.dev/netxms/apis/netxms-api/llms.txt) - [OpenAPI document](https://skmtc.dev/netxms/apis/netxms-api/revisions/740d85ba6674?raw)