Incident Object

Defines the schema for an incident in BigPanda


Different Objects

The Incidents V2 API and Notifications Webhook return different fields and formatting. This object page lists the fields for calls made to the Incidents V2 API.

To configure a sharing integration or notifications webhook, see the Webhook Incident Object.


The Incident object schema includes the following attributes:

idSystem-generated unique identifier for the incident.String
statusCurrent incident status, which is determined by the most severe status of the correlated alerts. Possible statuses: [critical, warning, unknown, ok].String
activeWhether the incident contains at least one active alert and has not been manually resolved. An incident is automatically resolved when all the alerts are resolved.Boolean
severityThe highest status the incident reachedString
flappingWhether at least one correlated alert has changed states frequently enough to be treated as flappingBoolean
sharedWhether the incident has been sharedBoolean
snoozeSnooze options for the incident
snoozed - Whether the incident is currently snoozed.
end_time - Time when the current snooze period expires. Unix epoch time when X (in seconds).
cancel_on_incident_updates - Whether the current snooze should be automatically cancelled if a new alert is added, the severity of an existing alert increases, or the incident is resolved and then reopens.
maintenanceWhether an incident is in maintenance
null - not in maintenance
partial - one of the alerts is in maintenance
active - all alerts in maintenance
correlation_matchers_logLog of the correlation patterns matched to the incident over time.

As more alerts are added to the incident, the matched correlation patterns may change. When this happens, another array is added that contains the matching correlation patterns at that time.

Correlation Pattern Attributes:

correlation pattern id - system generated unique identifier for the correlation pattern.

time window - The time frame in which this pattern will correlate incoming alerts.
alert tags - Alert tags that match the correlation pattern rules.

The last item in the array is the most recent one.

If multiple correlation patterns match the incident, the pattern with the longest time window is the one that appears in the UI. See the Algorithmic Correlation documentation for more information.

When an incident is split, only the source incident maintains the correlation_matchers_log.
Array of Objects
startUnix epoch time when the earliest correlated alert was received (in seconds).Timestamp (in seconds)
changed_atUnix epoch time when the last incident change triggered applicable sharing updates (in seconds).Timestamp (in seconds)
updated_atUnix epoch time when the last change to the incident occurred (in seconds).Timestamp (in seconds)
endUnix epoch time when the incident was resolved, either manually or automatically when all alerts were resolved (in seconds).Timestamp (in seconds)
alertsArray of the alerts that the incident contains.

alert_id - System-generated unique identifier for the alert.

When the request comes with expand=alerts, it sends an array of alert object data.
assigneeThe user assigned responsibility to see an incident through resolution
name - in system name of user
user_id - unique identifier of user
email - email associated with user
assignerThe user who assigned responsibility for an incident
name - in system name of user
user_id - unique identifier of user
email - email associated with user
environmentsEnvironment IDs for all environments the incident appears inArray
foldersFolder name of all folders the incident appears inArray
incident_tagsIncident tags associated with the incident
id - unique identifier for the tag
name - in system tag name
type - whether the tag is a Text, Priority or MultiValue tag
value - value of the incident tag according to its type

Sample Object:

  "id": "60a4ee83bb7d9d046b8d7a93",
  "status": "Ok",
  "active": false,
  "severity": "Critical",
  "flapping": false,
  "shared": false,
  "maintenance": null,
  "start": 1621421699,
  "changed_at": 1629410549,
  "updated_at": 1629410549,
  "end": 1629410549,
  "alerts": [
      "alert_id": "60a4ee83bb7d9d046b8d7a93"
  "environments": [],
  "folders": [],
  "incident_tags": [],
  "correlation_matchers_log": [
        "time_window": 7200,
        "tags": [
            "name": "case",
            "value": "sensitive1"
        "correlation_id": "a02fde2f-0ec3-4cc2-9cbd-74895cb13050",
        "source_system": "api.backend_monitoring"