OPopenobserve
OnCall

The on-call records that paged for an incident

get/api/{org_id}/oncall/incidents/{incident_id}/responses

Request

Path parameters

org_idstring required

Organization name

incident_idstring required

Incident ID

Response

Success

acked_atinteger nullable
acked_bystring nullable
cause'config_change_or_deploy' | 'capacity_or_load' | 'dependency_failure' | 'expected_or_maintenance' | 'noisy_threshold' | 'data_or_ingestion_issue' | 'genuine_defect' | 'still_unknown'

Why a page turned out to happen.

A fixed list rather than free text, so the next firing of the same rule can say "3× config change". Free text fragments into near-duplicates and never groups. Nuance goes in cause_note.

cause_notestring nullable

The sentence beside the structured cause. One dropdown plus one line is the whole ask — anything longer does not get filled in at 3am.

closed_atinteger nullable
exhausted_atinteger nullable

When the ladder ran out with nobody answering. None while it is still climbing, or if somebody took it first.

Deliberately NOT a ResponseState. An exhausted page can still be acknowledged and resolved, so a lifecycle state would force a false either/or: exhaustion is a property of the ladder, the state is a property of the human.

idstring required
incident_idstring nullable

Set only when this firing also produced an incident. A record is never owned by an incident, so this stays None for most firings.

ladder_anchorinteger nullable

Where step delays count from: opened_at, moved by a snooze or a triage-held first page.

ladder_runinteger nullable

Which run of the ladder the record is on.

Handing a page to another person or team starts a new run, and the ledger is read per run — which is what makes the receiving responder's ladder begin at its first rung. Absent means the first run.

opened_atinteger required
org_idstring required
origin_response_idstring nullable

For an impacted record, the owner record it was opened alongside.

priorityinteger required

AlertPriority::to_i32 — the same scale alerts already use.

responder_role'owner' | 'impacted'

Why this team was paged.

A database goes down and five services break. The owner fixes the database; the impacted teams contain the blast radius on their own service. Different jobs, so they get different records, and each team acks and resolves its own.

snoozed_untilinteger nullable

Quiet until this instant, in micros.

Not an acknowledgement: snoozing says "I know, stop shouting", not "I have this". The record stays open and unowned and the ladder resumes when it expires — which is what makes it safe to offer.

state'triggered' | 'triaged' | 'acknowledged' | 'resolved' required

Lifecycle of a response record: triggered → triaged → acknowledged → resolved. triaged comes from the L0 agent and is skipped entirely when the agent is absent or disabled.

team_idstring nullable

The team that owns this firing, or None when routing found nobody.

A teamless record pages nobody — no policy, no rotation, no ladder — and exists so the firing appears beside the ones that did page. Handing it to a team gives it an owner and starts its ladder (R-D6).

titlestring nullable

What the page is about. Kept on the record so it survives the alert being renamed or deleted.

updated_atinteger

Revision of the write this record came from, and what a replica accepts or refuses a snapshot on. The queue redelivers an unacked message behind newer ones, so a blind apply lets an older snapshot un-acknowledge a page that a human already answered.

Changes

No recorded changes to this operation across all 1 revision of this API.