---
title: "List alert incidents"
method: GET
path: "/api/v2/{org_id}/alerts/incidents"
tags: ["Incidents"]
---

# List alert incidents

`GET /api/v2/{org_id}/alerts/incidents`

## Request

- Base URL: `https://api.openobserve.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openobserve.ai/api/v2/{org_id}/alerts/incidents`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/openobserve/apis/openobserve-api-http/docs/api/v2/:org_id/alerts/incidents/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieves a list of correlated alert incidents with optional status filtering and pagination.

## Path parameters

- `org_id` string, required

## Query parameters

- `status` string, nullable
- `limit` integer
- `offset` integer

## Response `200`

Success

- ListIncidentsResponse: Response for list incidents
  - `incidents` Incident[], required
    - `acknowledged_at` integer, nullable
    - `acknowledged_by` string, nullable
    - `alert_count` integer, required
    - `alert_groups` IncidentAlertGroup[], nullable: Every alert that fired into the incident and how often, most-fired first; list only.
      - `alert_id` string, required
      - `alert_name` string, required
      - `count` integer, required: Times this alert fired into the incident
    - `assigned_to` string, nullable
    - `created_at` integer, required
    - `first_alert_at` integer, required: Timestamps in microseconds
    - `group_values` unknown
    - `id` string, required: KSUID (27 chars)
    - `key_type` 'alert_id' | 'secondary' | 'primary': Classification of correlation key strength for hierarchical upgrade logic Hierarchy: AlertId (weakest) → Secondary → Primary (strongest) Upgrades only move UP the hierarchy, never down.
    - `last_alert_at` integer, required
    - `muted_by_downtime_id` string, nullable: Set while a downtime mutes this incident (D3).
    - `org_id` string, required
    - `rca` RcaSummary, nullable: Run summary of an incident's latest run.
      - `current_run` RcaRun: One analysis run (`rca_runs` row).
        - `cancelled_by` string, nullable
        - `confidence` string, nullable
        - `context_used` unknown
        - `continuations` integer: Continuation turns the run used.
        - `deadline_closed_at` integer, nullable: When the sweeper closed the answer deadline, µs.
        - `ended_at` integer, nullable
        - `error` RunError: `rca_runs.error` of a `failed` run.
          - `code` string, required
          - `details` string, nullable
          - `reason` string, required
          - `trigger_type` string, nullable
        - `guidance` string, nullable
        - `incident_id` string, nullable
        - `input_deadline_at` integer, nullable: Answer deadline of a `waiting_input` run, µs.
        - `mode` 'fresh' | 'build_on_previous', required
        - `oncall_subjects` unknown
        - `outcome` string, nullable
        - `pending_question_id` string, nullable: `callID` of the open question of a `waiting_input` run.
        - `questions_asked` integer: Questions the run asked.
        - `report` string, nullable: Absent rather than null while the run has no report.
        - `report_format` 'v1' | 'v2', required: Where a report lives: `v1` in pre-run `topology_context`, `v2` in an `rca_runs` row.
        - `result` unknown
        - `run_id` string, required
        - `session_id` string, nullable
        - `stage` string, nullable: Current stage of the seven-stage protocol.
        - `stage_index` integer, nullable
        - `started_at` integer, required
        - `started_by` string, required
        - `state` 'running' | 'waiting_input' | 'completed' | 'failed' | 'cancelled', required: State of one analysis run. `stale` is computed, not a state.
        - `stats` RunStats: `rca_runs.stats`.
          - `credits` number, double, nullable
          - `duration_ms` integer, nullable
          - `ignored_acks` integer, nullable: Acks after the first for the same steering row.
          - `steered` integer, nullable
          - `steps` integer, nullable
          - `tokens` unknown
          - `tool_calls` integer, nullable
        - `subject_id` string, required
        - `subject_type` 'incident' | 'alert', required
        - `trigger` 'auto_new_incident' | 'auto_new_alert_type' | 'auto_reopen' | 'manual' | 'reanalyze' | 'oncall_page' | 'resume' | 'legacy', required: What started a run.
        - `updated_at` integer, required
      - `history` RcaRunItem[], required
        - `cancelled_by` string, nullable
        - `confidence` string, nullable
        - `ended_at` integer, nullable
        - `error_reason` string, nullable: `error.reason` of a failed run.
        - `has_record` boolean: The run stored a record, so a cancelled or failed run's partial ledger still opens.
        - `mode` 'fresh' | 'build_on_previous', required
        - `outcome` string, nullable
        - `report_format` 'v1' | 'v2', required: Where a report lives: `v1` in pre-run `topology_context`, `v2` in an `rca_runs` row.
        - `run_id` string, required
        - `started_at` integer, required
        - `started_by` string, required
        - `state` 'running' | 'waiting_input' | 'completed' | 'failed' | 'cancelled', required: State of one analysis run. `stale` is computed, not a state.
        - `subject_type` 'incident' | 'alert', required
        - `trigger` 'auto_new_incident' | 'auto_new_alert_type' | 'auto_reopen' | 'manual' | 'reanalyze' | 'oncall_page' | 'resume' | 'legacy', required: What started a run.
      - `report_run` RcaRunItem: One row of a run history list.
        - `cancelled_by` string, nullable
        - `confidence` string, nullable
        - `ended_at` integer, nullable
        - `error_reason` string, nullable: `error.reason` of a failed run.
        - `has_record` boolean: The run stored a record, so a cancelled or failed run's partial ledger still opens.
        - `mode` 'fresh' | 'build_on_previous', required
        - `outcome` string, nullable
        - `report_format` 'v1' | 'v2', required: Where a report lives: `v1` in pre-run `topology_context`, `v2` in an `rca_runs` row.
        - `run_id` string, required
        - `started_at` integer, required
        - `started_by` string, required
        - `state` 'running' | 'waiting_input' | 'completed' | 'failed' | 'cancelled', required: State of one analysis run. `stale` is computed, not a state.
        - `subject_type` 'incident' | 'alert', required
        - `trigger` 'auto_new_incident' | 'auto_new_alert_type' | 'auto_reopen' | 'manual' | 'reanalyze' | 'oncall_page' | 'resume' | 'legacy', required: What started a run.
      - `resume_run_id` string, nullable
      - `confidence` string, nullable
      - `outcome` string, nullable
      - `report_format` 'v1' | 'v2', required: Where a report lives: `v1` in pre-run `topology_context`, `v2` in an `rca_runs` row.
      - `run_id` string, required
      - `stale` boolean, required: Computed by the server.
      - `started_at` integer, required
      - `state` 'running' | 'waiting_input' | 'completed' | 'failed' | 'cancelled', required: State of one analysis run. `stale` is computed, not a state.
      - `summary` RunSummaryFields, required: The `alert_incidents.rca_summary` JSON: display-only fields of the latest run.
        - `cancelled_by` string, nullable: Who cancelled the latest run (display only).
        - `deadline_at` integer, nullable: Answer deadline of a `waiting_input` run, µs.
        - `detail` string, nullable: One short line for the list cell (the failure reason).
        - `previous` PreviousResult: The newest usable result of an earlier run.
          - `confidence` string, nullable
          - `ended_at` integer, required
          - `outcome` string, nullable
          - `run_id` string, required
        - `reusable_steps` integer, nullable: Finished steps a Resume of the ended run keeps; `None` before the run ends.
        - `stage` string, nullable
        - `stage_count` integer
        - `stage_index` integer, nullable
        - `steered_by` string[]: Up to three users who steered the latest run, newest first.
        - `steps` integer
        - `tool_calls` integer
        - `unblocked_by` string, nullable
      - `updated_at` integer, required
    - `rca_off_reason` string, nullable: Why automatic analysis runs never start for this incident (`l0_off`).
    - `resolved_at` integer, nullable
    - `severity` 'P1' | 'P2' | 'P3' | 'P4', required: Incident severity levels (P1 = highest priority)
    - `status` 'open' | 'acknowledged' | 'resolved', required: Incident status lifecycle: Open → Acknowledged → Resolved
    - `title` string, nullable
    - `topology_context` IncidentTopology: Alert flow graph showing how alerts cascaded across services over time
      - `edges` AlertEdge[], required: Edges showing temporal and service dependency relationships
        - `edge_type` 'temporal' | 'service_dependency', required: Type of relationship between alert nodes
        - `from_node_index` integer, required: Source node index
        - `to_node_index` integer, required: Target node index
      - `nodes` AlertNode[], required: Alert nodes - each unique (service, alert) pair
        - `alert_count` integer, required: Number of times this alert fired
        - `alert_id` string, required: Unique alert identifier (from alert definition)
        - `alert_name` string, required: Human-readable alert name for display
        - `first_fired_at` integer, required: Timestamp of first occurrence (microseconds)
        - `last_fired_at` integer, required: Timestamp of last occurrence (microseconds)
        - `service_name` string, required: Service name (may be "unknown")
      - `related_incident_ids` string[], required: Related incident IDs (for cross-incident correlation)
    - `updated_at` integer, required
  - `total` integer, required

## Other responses

- `500`: Internal error

---

[API](https://skmtc.dev/openobserve/apis/openobserve-api-http.md) - [All operations](https://skmtc.dev/openobserve/apis/openobserve-api-http/llms.txt) - [OpenAPI document](https://skmtc.dev/openobserve/apis/openobserve-api-http/revisions/0529b8a10252?raw)