---
title: "Create an incident on a custom source"
method: POST
path: "/v1/incidents"
---

# Create an incident on a custom source

`POST /v1/incidents`

## Request

- Base URL: `https://statusstack.com/api`
- URL: `https://statusstack.com/api/v1/incidents`
- Auth: HTTP bearer

Opens an incident on a custom source the API key's team owns; shared vendor sources
are refused. Needs the `write` permission.

## Request body

- object
  - `source_id` string, uuid, required
  - `title` string, required
  - `description` string, nullable
  - `status` 'investigating' | 'identified' | 'monitoring' | 'resolved' | 'postmortem' | 'scheduled' | 'completed' | 'clear': `scheduled` and `completed` bound a maintenance window; `clear` is a provider's all-clear. `resolved`, `postmortem`, `completed` and `clear` are terminal.
  - `impact` 'none' | 'minor' | 'major' | 'critical' | 'maintenance'
  - `incident_scheduled_for` string, date-time, nullable: Required when `status` is `scheduled` or `incident_scheduled_until` is given.
  - `incident_scheduled_until` string, date-time, nullable: Must be after `incident_scheduled_for`.
  - `component_ids` string[]: Affected components; each must belong to the source.

## Response `201`

Incident created

- Incident
  - `id` string, uuid
  - `source_id` string, uuid
  - `title` string
  - `description` string, nullable
  - `status` 'investigating' | 'identified' | 'monitoring' | 'resolved' | 'postmortem' | 'scheduled' | 'completed' | 'clear': `scheduled` and `completed` bound a maintenance window; `clear` is a provider's all-clear. `resolved`, `postmortem`, `completed` and `clear` are terminal.
  - `impact` 'none' | 'minor' | 'major' | 'critical' | 'maintenance'
  - `started_at` string, date-time: When the provider opened the incident.
  - `resolved_at` string, date-time, nullable
  - `scheduled_for` string, date-time, nullable: Start of a scheduled maintenance window; null for an unplanned incident.
  - `scheduled_until` string, date-time, nullable: End of a scheduled maintenance window; null for an unplanned incident.
  - `url` string, uri, nullable: The provider's own page for this incident.
  - `updates` IncidentUpdate[]
    - `id` string, uuid
    - `incident_id` string, uuid
    - `status` 'investigating' | 'identified' | 'monitoring' | 'resolved' | 'postmortem' | 'scheduled' | 'completed' | 'clear': `scheduled` and `completed` bound a maintenance window; `clear` is a provider's all-clear. `resolved`, `postmortem`, `completed` and `clear` are terminal.
    - `message` string, nullable
    - `created_at` string, date-time: When the provider posted the update.
  - `affected_components` Component[]: Components the incident affects, without the synthetic catch-all component that stands in for the service as a whole. Their `group_name` is omitted.
    - `id` string, uuid
    - `name` string
    - `description` string, nullable
    - `source_id` string, uuid
    - `status` 'operational' | 'degraded' | 'degraded_performance' | 'partial_outage' | 'major_outage' | 'maintenance' | 'unknown': The status vocabulary every v1 component surface speaks (`App\Support\ComponentWireStatus`), not the stored value. `degraded_performance` is echoed back in its stored spelling; every other degraded state maps to `degraded`. A status the alias table cannot place, or a component never checked, is `unknown` rather than being reported as healthy.
    - `group_name` string, nullable: Name of the component group this component sits in, or null for an ungrouped component. Present when the endpoint loads groups (the `/v1/sources` endpoints do; `affected_components` on incidents does not).
    - `created_at` string, date-time
    - `updated_at` string, date-time
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `401`: No bearer credentials, or credentials that do not resolve to an API key or Sanctum token. Produced by `ApiAuthentication` ahead of the route, so every operation in the v1 group can return it.
- `403`: The API key lacks the required permission, or a policy denied the action. The two come from different layers and return different bodies, so this is a union rather than one shape.
- `422`: The request body failed validation, or the write would exceed the organization's quota — `CheckQuota` also answers 422, with its own body.
- `429`: The `v1-api` rate limit (120 requests per minute) was exceeded. Applies to every operation in the v1 group.

---

[API](https://skmtc.dev/statusstack/apis/statusstack-api.md) - [All operations](https://skmtc.dev/statusstack/apis/statusstack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/statusstack/apis/statusstack-api/revisions/a5fabf6ac5e4?raw)