> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# incident.io

> Reference for the Tracecat incident.io integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Add alert tags

Action ID: `tools.incident_io.add_alert_tags`

Add tags to an alert without changing its existing tags. Calls POST /v2/alerts/\{id}/actions/add\_tags directly. Requires API key scope: alerts.edit.

Reference: [https://docs.incident.io/api-reference/alerts-v2/add-tags](https://docs.incident.io/api-reference/alerts-v2/add-tags)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

Unique identifier for the alert

**tags** `array[string]` *required*

Tag names to add to this alert

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Connect follow-up external issue

Action ID: `tools.incident_io.connect_follow_up_external_issue`

Connect a follow-up to an existing issue in an issue tracker, using the URL of the issue. Calls POST /v3/follow\_ups/\{id}/actions/connect\_external\_issue directly. Requires API key scope: follow\_ups.connect\_external\_issue.

Reference: [https://docs.incident.io/api-reference/follow-ups-v3/connect-external-issue](https://docs.incident.io/api-reference/follow-ups-v3/connect-external-issue)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

Unique identifier for the follow-up

**provider** `string` *required*

The issue tracker provider the issue belongs to. Allowed values: `asana`, `azure_devops`, `click_up`, `freshservice`, `linear`, `jira`, `salesforce`, `jira_server`, `github`, `gitlab`, `service_now`, `shortcut`, `notion`.

**url** `string` *required*

URL of the issue in the external provider

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Connect incident external issue

Action ID: `tools.incident_io.connect_incident_external_issue`

Connect an existing issue in an issue tracker to an incident, as its external issue. Calls POST /v2/incidents/\{id}/actions/connect\_external\_issue directly.

Reference: [https://docs.incident.io/api-reference/incidents-v2/connect-external-issue](https://docs.incident.io/api-reference/incidents-v2/connect-external-issue)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

The unique identifier of the incident

**issue\_template\_id** `string` *required*

ID of the incident ticket template to sync the issue with

**provider** `string` *required*

The issue tracker provider the issue belongs to. It must match the provider of the incident ticket template. Allowed values: `asana`, `azure_devops`, `click_up`, `freshservice`, `linear`, `jira`, `salesforce`, `jira_server`, `github`, `gitlab`, `service_now`, `shortcut`, `notion`.

**url** `string` *required*

URL of the issue in the issue tracker

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**replace** `boolean | null`

Whether to replace the incident's current external issue, if it has a different one

Default: `null`.

## Create action

Action ID: `tools.incident_io.create_action`

Create a new incident action. Calls POST /v3/actions directly. Requires API key scope: actions.create.

Reference: [https://docs.incident.io/api-reference/actions-v3/create](https://docs.incident.io/api-reference/actions-v3/create)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**description** `string` *required*

Description of the action. Supports Markdown.

**incident\_id** `string` *required*

Unique identifier of the incident the action belongs to

**assignee\_id** `string | null`

ID of the user this action is assigned to

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Create escalation

Action ID: `tools.incident_io.create_escalation`

Create an escalation. Calls POST /v2/escalations directly. Requires API key scope: escalations.create.

Reference: [https://docs.incident.io/api-reference/escalations-v2/create](https://docs.incident.io/api-reference/escalations-v2/create)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**idempotency\_key** `string` *required*

Unique key to prevent duplicate escalations. If this key has already been used, the existing escalation will be returned.

**title** `string` *required*

The title of the escalation. This message will be included in all notifications about this escalation.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**description** `string | null`

Additional details about the escalation

Default: `null`.

**escalation\_path\_id** `string | null`

ID of the escalation path to follow

Default: `null`.

**incident\_id** `string | null`

ID of an incident to associate with this escalation. The linked incident will appear in the escalation's related\_incidents field.

Default: `null`.

**user\_ids** `array[string] | null`

IDs of users to escalate directly to

Default: `null`.

## Create follow-up

Action ID: `tools.incident_io.create_follow_up`

Create a new incident follow-up. Calls POST /v3/follow\_ups directly. Requires API key scope: follow\_ups.create.

Reference: [https://docs.incident.io/api-reference/follow-ups-v3/create](https://docs.incident.io/api-reference/follow-ups-v3/create)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**incident\_id** `string` *required*

Unique identifier of the incident the follow-up belongs to

**title** `string` *required*

Title of the follow-up

**assignee\_id** `string | null`

ID of the user this follow-up is assigned to

Default: `null`.

**assignee\_team\_id** `string | null`

ID of the team this follow-up is assigned to

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**description** `string | null`

Description of the follow-up. Supports Markdown.

Default: `null`.

**external\_issue\_reference\_id** `string | null`

If this follow-up is related to an external issue, the ID of that issue

Default: `null`.

**follow\_up\_category\_id** `string | null`

ID of the category for this follow-up

Default: `null`.

**follow\_up\_priority\_option\_id** `string | null`

ID of the priority for this follow-up

Default: `null`.

**labels** `array[string] | null`

Labels associated with this follow-up

Default: `null`.

## Create HTTP alert event

Action ID: `tools.incident_io.create_http_alert_event`

Create an alert event using an HTTP source. Calls POST /v2/alert\_events/http/\{alert\_source\_config\_id} directly. Authenticates with the HTTP alert source secret, not an API key.

Reference: [https://docs.incident.io/api-reference/alert-events-v2/create](https://docs.incident.io/api-reference/alert-events-v2/create)

### Secrets

Required secrets:

* `incident_io_alert_source`: required values `INCIDENT_IO_ALERT_SOURCE_TOKEN`.

### Input fields

**alert\_source\_config\_id** `string` *required*

Which alert source config produced this alert

**status** `string` *required*

Current status of this alert. Allowed values: `firing`, `resolved`.

**title** `string` *required*

The title of the alert, parsed from the alert payload according to the alert source configuration

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**deduplication\_key** `string | null`

A deduplication key which uniquely references this alert from your alert source. For newly created HTTP sources, this field is required.
If you send an event with the same deduplication\_key multiple times, only one alert will be created in incident.io for this alert source config.
You can filter on this field to find the alert created by an event you've sent us.

Default: `null`.

**description** `string | null`

Description that optionally adds more detail to title. Supports markdown.

Default: `null`.

**metadata** `object | null`

Any additional metadata that you've configured your alert source to parse

Default: `null`.

**source\_url** `string | null`

If applicable, a link to the alert in the upstream system

Default: `null`.

## Create incident

Action ID: `tools.incident_io.create_incident`

Create a new incident. Calls POST /v2/incidents directly. Requires API key scope: incidents.create.

Reference: [https://docs.incident.io/api-reference/incidents-v2/create](https://docs.incident.io/api-reference/incidents-v2/create)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**idempotency\_key** `string` *required*

Unique string used to de-duplicate incident create requests

**visibility** `string` *required*

Whether the incident should be open to anyone in your Slack workspace (public), or invite-only (private). For more information on Private Incidents see our [docs](https://docs.incident.io/incidents/sensitive-incidents). Allowed values: `public`, `private`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**custom\_field\_entries** `array[object] | null`

Set the incident's custom fields to these values

Default: `null`.

**incident\_role\_assignments** `array[object] | null`

Assign incident roles to these people

Default: `null`.

**incident\_status\_id** `string | null`

Incident status to assign to the incident

Default: `null`.

**incident\_timestamp\_values** `array[object] | null`

Assign the incident's timestamps to these values

Default: `null`.

**incident\_type\_id** `string | null`

Incident type to create this incident as

Default: `null`.

**mode** `string | null`

Whether the incident is real, a test, a tutorial, or importing as a retrospective incident. Allowed values: `standard`, `retrospective`, `test`, `tutorial`.

Default: `null`.

**name** `string | null`

Explanation of the incident

Default: `null`.

**retrospective\_incident\_options** `object | null`

`retrospective_incident_options` object. Fields: external\_id, postmortem\_document\_url, slack\_channel\_id.

Default: `null`.

**severity\_id** `string | null`

Severity to create incident as

Default: `null`.

**slack\_channel\_name\_override** `string | null`

Name of the Slack channel to create for this incident

Default: `null`.

**slack\_team\_id** `string | null`

Slack Team to create the incident in

Default: `null`.

**summary** `string | null`

Detailed description of the incident

Default: `null`.

## Create incident alert

Action ID: `tools.incident_io.create_incident_alert`

Attach an alert to an incident, creating the connection between them. Calls POST /v2/incident\_alerts directly. Requires API key scope: alerts.attach\_to\_incident.

Reference: [https://docs.incident.io/api-reference/incident-alerts-v2/create](https://docs.incident.io/api-reference/incident-alerts-v2/create)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**alert\_id** `string` *required*

Alert to attach to the incident

**incident\_id** `string` *required*

Incident to attach the alert to

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**re\_relate** `boolean | null`

Relate the alert again even though someone previously marked it unrelated to this incident. Defaults to false, which preserves that decision and returns a 422

Default: `null`.

## Create incident update

Action ID: `tools.incident_io.create_incident_update`

Share an update against an incident. Calls POST /v2/incident\_updates directly. Requires API key scope: incident\_updates.create.

Reference: [https://docs.incident.io/api-reference/incident-updates-v2/create](https://docs.incident.io/api-reference/incident-updates-v2/create)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**idempotency\_key** `string` *required*

Unique string used to de-duplicate incident update requests. Retrying with the same key returns the update the first request created, rather than sharing a second one.

**incident\_id** `string` *required*

The incident you want to update

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**message** `string | null`

Message that explains the context behind the update, in markdown

Default: `null`.

**to\_incident\_status\_id** `string | null`

Move the incident to this status

Default: `null`.

**to\_severity\_id** `string | null`

Move the incident to this severity

Default: `null`.

## Create schedule override

Action ID: `tools.incident_io.create_schedule_override`

Create a new schedule override. Calls POST /v2/schedule\_overrides directly. Requires API key scope: schedule\_overrides.create.

Reference: [https://docs.incident.io/api-reference/schedule-overrides-v2/create](https://docs.incident.io/api-reference/schedule-overrides-v2/create)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**end\_at** `string` *required*

End time of the override

**layer\_id** `string` *required*

The layer this override applies to

**rotation\_id** `string` *required*

The rotation this override applies to

**schedule\_id** `string` *required*

The schedule this override applies to

**start\_at** `string` *required*

Start time of the override

**user** `object` *required*

`user` object. Fields: email, id, slack\_user\_id.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Delete action

Action ID: `tools.incident_io.delete_action`

Delete an incident action. Calls DELETE /v3/actions/\{id} directly. Requires API key scope: actions.destroy.

Reference: [https://docs.incident.io/api-reference/actions-v3/delete](https://docs.incident.io/api-reference/actions-v3/delete)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

Unique identifier for the action

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Delete schedule override

Action ID: `tools.incident_io.delete_schedule_override`

Delete a schedule override, restoring whoever the rotations put on-call for that window. Calls DELETE /v2/schedule\_overrides/\{id} directly. Requires API key scope: schedule\_overrides.destroy.

Reference: [https://docs.incident.io/api-reference/schedule-overrides-v2/delete](https://docs.incident.io/api-reference/schedule-overrides-v2/delete)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

The override ID to delete

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Edit incident

Action ID: `tools.incident_io.edit_incident`

Edit an existing incident. Calls POST /v2/incidents/\{id}/actions/edit directly.

Reference: [https://docs.incident.io/api-reference/incidents-v2/edit](https://docs.incident.io/api-reference/incidents-v2/edit)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

The unique identifier of the incident that you want to edit

**incident** `object` *required*

`incident` object. Fields: call\_url, custom\_field\_entries, incident\_role\_assignments, incident\_status\_id, incident\_timestamp\_values, name, severity\_id, slack\_channel\_name\_override, summary.

**notify\_incident\_channel** `boolean` *required*

Should we send Slack channel notifications to inform responders of this update? Note that this won't work if the Slack channel has already been archived.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Get alert

Action ID: `tools.incident_io.get_alert`

Show a single alert for your account. Calls GET /v2/alerts/\{id} directly. Requires API key scope: alerts.view.

Reference: [https://docs.incident.io/api-reference/alerts-v2/show](https://docs.incident.io/api-reference/alerts-v2/show)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

Unique identifier for the alert

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Get catalog entry

Action ID: `tools.incident_io.get_catalog_entry`

Show a single catalog entry. Calls GET /v3/catalog\_entries/\{id} directly. Requires API key scope: catalog\_entries.view.

Reference: [https://docs.incident.io/api-reference/catalog-entries-v3/show-entry](https://docs.incident.io/api-reference/catalog-entries-v3/show-entry)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

ID of this catalog entry

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**expand** `boolean | null`

Whether to include details of all attribute links (forwards and backwards) within the response. Default behaviour (no query param) is to include only forward links. When expand is false, we only show attributes of the catalog entry itself.When expand is true, we show forward and backward links

Default: `null`.

## Get escalation

Action ID: `tools.incident_io.get_escalation`

Show a specific escalation. Calls GET /v2/escalations/\{id} directly. Requires API key scope: escalations.view.

Reference: [https://docs.incident.io/api-reference/escalations-v2/show](https://docs.incident.io/api-reference/escalations-v2/show)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

Unique ID of the escalation

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Get escalation path

Action ID: `tools.incident_io.get_escalation_path`

Show an escalation path. Calls GET /v2/escalation\_paths/\{id} directly. Requires API key scope: escalation\_paths.view.

Reference: [https://docs.incident.io/api-reference/escalation-paths-v2/show](https://docs.incident.io/api-reference/escalation-paths-v2/show)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

Unique identifier for this escalation path.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Get incident

Action ID: `tools.incident_io.get_incident`

Get a single incident. Calls GET /v2/incidents/\{id} directly. Requires API key scope: incidents.view.

Reference: [https://docs.incident.io/api-reference/incidents-v2/show](https://docs.incident.io/api-reference/incidents-v2/show)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

Unique identifier for the incident

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Get schedule

Action ID: `tools.incident_io.get_schedule`

Get a single schedule. Calls GET /v2/schedules/\{id} directly. Requires API key scope: schedules.view.

Reference: [https://docs.incident.io/api-reference/schedules-v2/show](https://docs.incident.io/api-reference/schedules-v2/show)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

Unique internal ID of the schedule

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## List actions

Action ID: `tools.incident_io.list_actions`

List actions for an organisation. Calls GET /v3/actions directly. Requires API key scope: actions.view.

Reference: [https://docs.incident.io/api-reference/actions-v3/list](https://docs.incident.io/api-reference/actions-v3/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

An action's ID. This endpoint will return a list of actions after this ID in relation to the API response order.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**created\_at\_date\_range** `string | null`

Filter on action created at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `date_range` operator. Two dates joined by `~`, for example `2024-12-02~2024-12-08`.

Default: `null`.

**created\_at\_gte** `string | null`

Filter on action created at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `gte` operator.

Default: `null`.

**created\_at\_lte** `string | null`

Filter on action created at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `lte` operator.

Default: `null`.

**incident\_id** `string | null`

Find actions related to this incident

Default: `null`.

**incident\_mode** `string | null`

Filter to actions from incidents of the given mode. If not set, only actions from `standard` and `retrospective` incidents are returned. Allowed values: `standard`, `retrospective`, `test`, `tutorial`, `stream`.

Default: `null`.

**page\_size** `integer | null`

Integer number of records to return. Maximum 250.

Default: `null`.

**updated\_at\_date\_range** `string | null`

Filter on action updated at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `date_range` operator. Two dates joined by `~`, for example `2024-12-02~2024-12-08`.

Default: `null`.

**updated\_at\_gte** `string | null`

Filter on action updated at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `gte` operator.

Default: `null`.

**updated\_at\_lte** `string | null`

Filter on action updated at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `lte` operator.

Default: `null`.

## List alert sources

Action ID: `tools.incident_io.list_alert_sources`

List all alert sources in your account. Calls GET /v2/alert\_sources directly. Requires API key scope: alert\_sources.view.

Reference: [https://docs.incident.io/api-reference/alert-sources-v2/list](https://docs.incident.io/api-reference/alert-sources-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## List alert tags

Action ID: `tools.incident_io.list_alert_tags`

List the alert tags in your organisation's vocabulary. Calls GET /v2/alert\_tags directly. Requires API key scope: alerts.view.

Reference: [https://docs.incident.io/api-reference/alert-tags-v2/list](https://docs.incident.io/api-reference/alert-tags-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

A tag's ID. This endpoint will return a list of tags after this ID in relation to the API response order.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**page\_size** `integer | null`

Integer number of records to return. Maximum 250.

Default: `null`.

**search** `string | null`

Filter to tags whose name contains this value (case-insensitive)

Default: `null`.

## List alerts

Action ID: `tools.incident_io.list_alerts`

List all alerts for your account. \`\`\`bash. Calls GET /v2/alerts directly. Requires API key scope: alerts.view.

Reference: [https://docs.incident.io/api-reference/alerts-v2/list](https://docs.incident.io/api-reference/alerts-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

If provided, pass this as the 'after' param to load the next page

Default: `null`.

**alert\_group\_id\_one\_of** `array[string] | null`

Filter on alert group ID. Returns alerts that belong to any of the specified groups. The accepted operator is 'one\_of'. Value for the `one_of` operator.

Default: `null`.

**alert\_source\_not\_in** `array[string] | null`

Filter on alert source by ID. The accepted operators are 'one\_of', or 'not\_in'. Value for the `not_in` operator.

Default: `null`.

**alert\_source\_one\_of** `array[string] | null`

Filter on alert source by ID. The accepted operators are 'one\_of', or 'not\_in'. Value for the `one_of` operator.

Default: `null`.

**attributes** `object | null`

Filter on an alerts attributes. Alert attribute ID should be sent, followed by the operator and values. Accepted operator will depend on the attribute type. Sent as deepObject query parameters, for example `{"01GBSQF3FHF7FWZQNWGHAVQ804": {"one_of": ["01GBSQF3FHF7FWZQNWGHAVQ804", "01ET65M7ZARSFZ6TFDFVQDN9AA"]}}`.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**created\_at\_date\_range** `string | null`

Filter on alert created at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `date_range` operator. Two dates joined by `~`, for example `2024-12-02~2024-12-08`.

Default: `null`.

**created\_at\_gte** `string | null`

Filter on alert created at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `gte` operator.

Default: `null`.

**created\_at\_lte** `string | null`

Filter on alert created at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `lte` operator.

Default: `null`.

**deduplication\_key\_is** `string | null`

Filter on alert deduplication key. The accepted operator is 'is'. Value for the `is` operator.

Default: `null`.

**has\_notes\_is** `string | null`

Filter on whether an alert has notes. The accepted operator is 'is'. Value for the `is` operator.

Default: `null`.

**include\_maintenance\_window\_is** `string | null`

Filter on whether to include maintenance window alerts. The accepted operator is 'is'. Value for the `is` operator.

Default: `null`.

**page\_size** `integer | null`

Number of alerts to return per page. Maximum 50.

Default: `null`.

**status\_not\_in** `array[string] | null`

Filter on alert status. The accepted operators are 'one\_of', or 'not\_in'. Value for the `not_in` operator.

Default: `null`.

**status\_one\_of** `array[string] | null`

Filter on alert status. The accepted operators are 'one\_of', or 'not\_in'. Value for the `one_of` operator.

Default: `null`.

**tags\_all\_of** `array[string] | null`

Filter on the tags applied to an alert, by tag name. The accepted operators are 'one\_of', 'all\_of' and 'not\_in'. Value for the `all_of` operator.

Default: `null`.

**tags\_not\_in** `array[string] | null`

Filter on the tags applied to an alert, by tag name. The accepted operators are 'one\_of', 'all\_of' and 'not\_in'. Value for the `not_in` operator.

Default: `null`.

**tags\_one\_of** `array[string] | null`

Filter on the tags applied to an alert, by tag name. The accepted operators are 'one\_of', 'all\_of' and 'not\_in'. Value for the `one_of` operator.

Default: `null`.

**updated\_at\_date\_range** `string | null`

Filter on alert updated at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `date_range` operator. Two dates joined by `~`, for example `2024-12-02~2024-12-08`.

Default: `null`.

**updated\_at\_gte** `string | null`

Filter on alert updated at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `gte` operator.

Default: `null`.

**updated\_at\_lte** `string | null`

Filter on alert updated at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `lte` operator.

Default: `null`.

## List catalog entries

Action ID: `tools.incident_io.list_catalog_entries`

List entries for a catalog type. Calls GET /v3/catalog\_entries directly. Requires API key scope: catalog\_entries.view.

Reference: [https://docs.incident.io/api-reference/catalog-entries-v3/list-entries](https://docs.incident.io/api-reference/catalog-entries-v3/list-entries)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

An record's ID. This endpoint will return a list of records after this ID in relation to the API response order.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**catalog\_type\_id** `string | null`

ID of this catalog type

Default: `null`.

**identifier** `string | null`

If specified, only entries with this identifier will be returned. This will search by ID, external ID, and aliases.

If 'use name as identifier' is enabled for the catalog type, this will also match on name.

Default: `null`.

**page\_size** `integer | null`

The integer number of records to return. Maximum 250.

Default: `null`.

## List catalog types

Action ID: `tools.incident_io.list_catalog_types`

List all catalog types for an organisation, including those synced from external resources. Calls GET /v3/catalog\_types directly. Requires API key scope: catalog\_types.view.

Reference: [https://docs.incident.io/api-reference/catalog-types-v3/list-types](https://docs.incident.io/api-reference/catalog-types-v3/list-types)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## List custom field options

Action ID: `tools.incident_io.list_custom_field_options`

Show custom field options for a custom field. Calls GET /v1/custom\_field\_options directly. Requires API key scope: custom\_fields.view.

Reference: [https://docs.incident.io/api-reference/custom-field-options-v1/list](https://docs.incident.io/api-reference/custom-field-options-v1/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

A custom field option's ID. This endpoint will return a list of custom field options created after this option.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**custom\_field\_id** `string | null`

The custom field to list options for.

Default: `null`.

**page\_size** `integer | null`

Integer number of records to return. Maximum 250.

Default: `null`.

## List custom fields

Action ID: `tools.incident_io.list_custom_fields`

List all custom fields for an organisation. Calls GET /v2/custom\_fields directly. Requires API key scope: custom\_fields.view.

Reference: [https://docs.incident.io/api-reference/custom-fields-v2/list](https://docs.incident.io/api-reference/custom-fields-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## List escalation paths

Action ID: `tools.incident_io.list_escalation_paths`

List all escalation paths in your account. Calls GET /v2/escalation\_paths directly. Requires API key scope: escalation\_paths.view.

Reference: [https://docs.incident.io/api-reference/escalation-paths-v2/list](https://docs.incident.io/api-reference/escalation-paths-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

An record's ID. This endpoint will return a list of records after this ID in relation to the API response order.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**page\_size** `integer | null`

Integer number of records to return. Maximum 25.

Default: `null`.

## List escalations

Action ID: `tools.incident_io.list_escalations`

List all escalations for your account. Calls GET /v2/escalations directly. Requires API key scope: escalations.view.

Reference: [https://docs.incident.io/api-reference/escalations-v2/list](https://docs.incident.io/api-reference/escalations-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

An escalation's ID. This endpoint will return a list of escalations after this ID in relation to the API response order.

Default: `null`.

**alert\_not\_in** `array[string] | null`

Filter on the alert that created an escalation. Accepted operators are 'one\_of' and 'not\_in'. Value for the `not_in` operator.

Default: `null`.

**alert\_one\_of** `array[string] | null`

Filter on the alert that created an escalation. Accepted operators are 'one\_of' and 'not\_in'. Value for the `one_of` operator.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**created\_at\_date\_range** `string | null`

Filter on the created\_at timestamp of the escalation. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `date_range` operator. Two dates joined by `~`, for example `2024-12-02~2024-12-08`.

Default: `null`.

**created\_at\_gte** `string | null`

Filter on the created\_at timestamp of the escalation. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `gte` operator.

Default: `null`.

**created\_at\_lte** `string | null`

Filter on the created\_at timestamp of the escalation. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `lte` operator.

Default: `null`.

**escalation\_path\_not\_in** `array[string] | null`

Filter on the escalation path for which the escalation was triggered. Accepted operators are 'one\_of' and 'not\_in'. Value for the `not_in` operator.

Default: `null`.

**escalation\_path\_one\_of** `array[string] | null`

Filter on the escalation path for which the escalation was triggered. Accepted operators are 'one\_of' and 'not\_in'. Value for the `one_of` operator.

Default: `null`.

**idempotency\_key\_is** `string | null`

Filter on the idempotency key of the escalation. This is the key set when creating escalations via the API, and is distinct from alert deduplication keys. Accepted operators are 'is' for exact matches and 'starts\_with' for prefix matching. Value for the `is` operator.

Default: `null`.

**idempotency\_key\_starts\_with** `string | null`

Filter on the idempotency key of the escalation. This is the key set when creating escalations via the API, and is distinct from alert deduplication keys. Accepted operators are 'is' for exact matches and 'starts\_with' for prefix matching. Value for the `starts_with` operator.

Default: `null`.

**incident\_not\_in** `array[string] | null`

Filter on the incident that the escalation is connected to. Accepted operators are 'one\_of' and 'not\_in'. Value for the `not_in` operator.

Default: `null`.

**incident\_one\_of** `array[string] | null`

Filter on the incident that the escalation is connected to. Accepted operators are 'one\_of' and 'not\_in'. Value for the `one_of` operator.

Default: `null`.

**page\_size** `integer | null`

Number of escalations to return per page. Maximum 50.

Default: `null`.

**status\_not\_in** `array[string] | null`

Filter on the status of the escalation. Accepted operators are 'one\_of' and 'not\_in'. Value for the `not_in` operator.

Default: `null`.

**status\_one\_of** `array[string] | null`

Filter on the status of the escalation. Accepted operators are 'one\_of' and 'not\_in'. Value for the `one_of` operator.

Default: `null`.

**updated\_at\_date\_range** `string | null`

Filter on the updated\_at timestamp of the escalation. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `date_range` operator. Two dates joined by `~`, for example `2024-12-02~2024-12-08`.

Default: `null`.

**updated\_at\_gte** `string | null`

Filter on the updated\_at timestamp of the escalation. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `gte` operator.

Default: `null`.

**updated\_at\_lte** `string | null`

Filter on the updated\_at timestamp of the escalation. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `lte` operator.

Default: `null`.

## List follow-ups

Action ID: `tools.incident_io.list_follow_ups`

List follow-ups for an organisation. Calls GET /v3/follow\_ups directly. Requires API key scope: actions.view.

Reference: [https://docs.incident.io/api-reference/follow-ups-v3/list](https://docs.incident.io/api-reference/follow-ups-v3/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

A follow-up's ID. This endpoint will return a list of follow-ups after this ID in relation to the API response order.

Default: `null`.

**assignee\_team\_id** `string | null`

Filter follow-ups that are assigned to the given team

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**created\_at\_date\_range** `string | null`

Filter on follow-up created at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `date_range` operator. Two dates joined by `~`, for example `2024-12-02~2024-12-08`.

Default: `null`.

**created\_at\_gte** `string | null`

Filter on follow-up created at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `gte` operator.

Default: `null`.

**created\_at\_lte** `string | null`

Filter on follow-up created at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `lte` operator.

Default: `null`.

**incident\_id** `string | null`

Find follow-ups related to this incident

Default: `null`.

**incident\_mode** `string | null`

Filter to follow-ups from incidents of the given mode. If not set, only follow-ups from `standard` and `retrospective` incidents are returned. Allowed values: `standard`, `retrospective`, `test`, `tutorial`, `stream`.

Default: `null`.

**page\_size** `integer | null`

Integer number of records to return. Maximum 250.

Default: `null`.

**updated\_at\_date\_range** `string | null`

Filter on follow-up updated at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `date_range` operator. Two dates joined by `~`, for example `2024-12-02~2024-12-08`.

Default: `null`.

**updated\_at\_gte** `string | null`

Filter on follow-up updated at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `gte` operator.

Default: `null`.

**updated\_at\_lte** `string | null`

Filter on follow-up updated at timestamp. Accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `lte` operator.

Default: `null`.

## List incident alerts

Action ID: `tools.incident_io.list_incident_alerts`

List the connections between incidents and alerts. Calls GET /v2/incident\_alerts directly. Requires API key scope: alerts.view.

Reference: [https://docs.incident.io/api-reference/incident-alerts-v2/list](https://docs.incident.io/api-reference/incident-alerts-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

If provided, pass this as the 'after' param to load the next page

Default: `null`.

**alert\_id** `string | null`

Alert that this incident alert refers to

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**incident\_id** `string | null`

Incident that this incident alert is attached to

Default: `null`.

**page\_size** `integer | null`

Number of incident alerts to return per page. Maximum 50.

Default: `null`.

## List incident roles

Action ID: `tools.incident_io.list_incident_roles`

List all incident roles for an organisation. Calls GET /v2/incident\_roles directly. Requires API key scope: incident\_roles.view.

Reference: [https://docs.incident.io/api-reference/incident-roles-v2/list](https://docs.incident.io/api-reference/incident-roles-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## List incident statuses

Action ID: `tools.incident_io.list_incident_statuses`

List all incident statuses for an organisation. Calls GET /v1/incident\_statuses directly. Requires API key scope: incident\_statuses.view.

Reference: [https://docs.incident.io/api-reference/incident-statuses-v1/list](https://docs.incident.io/api-reference/incident-statuses-v1/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## List incident types

Action ID: `tools.incident_io.list_incident_types`

List all incident types for an organisation. Calls GET /v1/incident\_types directly. Requires API key scope: incident\_types.view.

Reference: [https://docs.incident.io/api-reference/incident-types-v1/list](https://docs.incident.io/api-reference/incident-types-v1/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## List incident updates

Action ID: `tools.incident_io.list_incident_updates`

List all incident updates for an organisation, or for a specific incident. Calls GET /v2/incident\_updates directly. Requires API key scope: incidents.view.

Reference: [https://docs.incident.io/api-reference/incident-updates-v2/list](https://docs.incident.io/api-reference/incident-updates-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

An record's ID. This endpoint will return a list of records after this ID in relation to the API response order.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**incident\_id** `string | null`

Incident whose updates you want to list

Default: `null`.

**page\_size** `integer | null`

Integer number of records to return. Maximum 250.

Default: `null`.

## List incidents

Action ID: `tools.incident_io.list_incidents`

List all incidents for an organisation. Calls GET /v2/incidents directly. Requires API key scope: incidents.view.

Reference: [https://docs.incident.io/api-reference/incidents-v2/list](https://docs.incident.io/api-reference/incidents-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

An incident's ID. This endpoint will return a list of incidents after this ID in relation to the API response order.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**created\_at\_date\_range** `string | null`

Filter on incident created at timestamp. The accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `date_range` operator. Two dates joined by `~`, for example `2024-12-02~2024-12-08`.

Default: `null`.

**created\_at\_gte** `string | null`

Filter on incident created at timestamp. The accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `gte` operator.

Default: `null`.

**created\_at\_lte** `string | null`

Filter on incident created at timestamp. The accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `lte` operator.

Default: `null`.

**custom\_field** `object | null`

Filter on an incident custom field. Custom field ID should be sent, followed by the operator and values. Accepted operator will depend on the custom field type. Sent as deepObject query parameters, for example `{"01GBSQF3FHF7FWZQNWGHAVQ804": {"one_of": ["01GBSQF3FHF7FWZQNWGHAVQ804", "01ET65M7ZARSFZ6TFDFVQDN9AA"]}}`.

Default: `null`.

**filter\_mode** `string | null`

How to combine the filters: 'all' combines them with AND logic (all must match), 'any' combines them with OR logic (any can match). Defaults to 'all'.

Default: `null`.

**incident\_role** `object | null`

Filter on an incident role. Role ID should be sent, along with backlink attribute ID (if needed) followed by the operator and values. The accepted operators are 'one\_of', 'is\_blank'. Sent as deepObject query parameters, for example `{"01GBSQF3FHF7FWZQNWGHAVQ804": {"one_of": ["01GBSQF3FHF7FWZQNWGHAVQ804", "01ET65M7ZARSFZ6TFDFVQDN9AA"]}}`.

Default: `null`.

**incident\_type\_not\_in** `array[string] | null`

Filter on incident type. The accepted operators are 'one\_of, or 'not\_in'. Value for the `not_in` operator.

Default: `null`.

**incident\_type\_one\_of** `array[string] | null`

Filter on incident type. The accepted operators are 'one\_of, or 'not\_in'. Value for the `one_of` operator.

Default: `null`.

**mode\_one\_of** `array[string] | null`

Filter on incident mode. The accepted operator is 'one\_of'.  If this is not provided, this value defaults to `{"one_of": ["standard", "retrospective"] }`, meaning that test and tutorial incidents are not included. Value for the `one_of` operator.

Default: `null`.

**page\_size** `integer | null`

Integer number of records to return. Maximum 500.

Default: `null`.

**severity\_gte** `string | null`

Filter on incident severity. The accepted operators are 'one\_of', 'not\_in', 'gte', 'lte'. Value for the `gte` operator.

Default: `null`.

**severity\_lte** `string | null`

Filter on incident severity. The accepted operators are 'one\_of', 'not\_in', 'gte', 'lte'. Value for the `lte` operator.

Default: `null`.

**severity\_not\_in** `array[string] | null`

Filter on incident severity. The accepted operators are 'one\_of', 'not\_in', 'gte', 'lte'. Value for the `not_in` operator.

Default: `null`.

**severity\_one\_of** `array[string] | null`

Filter on incident severity. The accepted operators are 'one\_of', 'not\_in', 'gte', 'lte'. Value for the `one_of` operator.

Default: `null`.

**sort\_by** `string | null`

What order to return results in. Allowed values: `created_at_newest_first`, `created_at_oldest_first`.

Default: `null`.

**status\_category\_not\_in** `array[string] | null`

Filter on the category of the incidents status. The accepted operators are 'one\_of', or 'not\_in'. Value for the `not_in` operator.

Default: `null`.

**status\_category\_one\_of** `array[string] | null`

Filter on the category of the incidents status. The accepted operators are 'one\_of', or 'not\_in'. Value for the `one_of` operator.

Default: `null`.

**status\_not\_in** `array[string] | null`

Filter on incident status. The accepted operators are 'one\_of', or 'not\_in'. Value for the `not_in` operator.

Default: `null`.

**status\_one\_of** `array[string] | null`

Filter on incident status. The accepted operators are 'one\_of', or 'not\_in'. Value for the `one_of` operator.

Default: `null`.

**updated\_at\_date\_range** `string | null`

Filter on incident updated at timestamp. The accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `date_range` operator. Two dates joined by `~`, for example `2024-12-02~2024-12-08`.

Default: `null`.

**updated\_at\_gte** `string | null`

Filter on incident updated at timestamp. The accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `gte` operator.

Default: `null`.

**updated\_at\_lte** `string | null`

Filter on incident updated at timestamp. The accepted operators are 'gte', 'lte' and 'date\_range'. Value for the `lte` operator.

Default: `null`.

## List schedule entries

Action ID: `tools.incident_io.list_schedule_entries`

List the schedule entries for a schedule over a window of time. Calls GET /v2/schedule\_entries directly. Requires API key scope: schedules.view.

Reference: [https://docs.incident.io/api-reference/schedule-entries-v2/list](https://docs.incident.io/api-reference/schedule-entries-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**entry\_window\_end** `string | null`

The end of the window to get entries for.

Default: `null`.

**entry\_window\_start** `string | null`

The start of the window to get entries for. May also carry an opaque pagination cursor previously returned in `pagination_meta.after` — pass it back here unchanged to fetch the next page (leave `entry_window_end` unchanged from the original request).

Default: `null`.

**schedule\_id** `string | null`

The ID of the schedule to get entries for.

Default: `null`.

## List schedules

Action ID: `tools.incident_io.list_schedules`

List configured schedules. Calls GET /v2/schedules directly. Requires API key scope: schedules.view.

Reference: [https://docs.incident.io/api-reference/schedules-v2/list](https://docs.incident.io/api-reference/schedules-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

A schedule's ID. This endpoint will return a list of schedules after this ID in relation to the API response order.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**page\_size** `integer | null`

Note that next\_shifts will only be returned when the page size is 25 or lower. Maximum 10000.

Default: `null`.

## List severities

Action ID: `tools.incident_io.list_severities`

List all incident severities for an organisation. Calls GET /v1/severities directly. Requires API key scope: severities.view.

Reference: [https://docs.incident.io/api-reference/severities-v1/list](https://docs.incident.io/api-reference/severities-v1/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## List teams

Action ID: `tools.incident_io.list_teams`

List all teams in the organisation. Calls GET /v3/teams directly. Requires API key scope: catalog\_entries.view.

Reference: [https://docs.incident.io/api-reference/teams-v3/list](https://docs.incident.io/api-reference/teams-v3/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

An record's ID. This endpoint will return a list of records after this ID in relation to the API response order.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**page\_size** `integer | null`

Integer number of records to return. Maximum 250.

Default: `null`.

## List users

Action ID: `tools.incident_io.list_users`

List users in your account. Calls GET /v2/users directly. Requires API key scope: users.view.

Reference: [https://docs.incident.io/api-reference/users-v2/list](https://docs.incident.io/api-reference/users-v2/list)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**after** `string | null`

An record's ID. This endpoint will return a list of records after this ID in relation to the API response order.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**email** `string | null`

Filter by email address

Default: `null`.

**include\_inactive** `boolean | null`

Include deactivated or not-yet-active users (defaults to false). Useful for resolving users who have since been offboarded.

Default: `null`.

**page\_size** `integer | null`

Integer number of records to return. Maximum 10000.

Default: `null`.

**slack\_user\_id** `string | null`

Filter by Slack user ID

Default: `null`.

## Remove alert tags

Action ID: `tools.incident_io.remove_alert_tags`

Remove tags from an alert without changing its other tags. Calls POST /v2/alerts/\{id}/actions/remove\_tags directly. Requires API key scope: alerts.edit.

Reference: [https://docs.incident.io/api-reference/alerts-v2/remove-tags](https://docs.incident.io/api-reference/alerts-v2/remove-tags)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

Unique identifier for the alert

**tags** `array[string]` *required*

Tag names to remove from this alert

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Resolve alert

Action ID: `tools.incident_io.resolve_alert`

Resolve a currently firing alert. Calls POST /v2/alerts/\{id}/actions/resolve directly. Requires API key scope: alerts.resolve.

Reference: [https://docs.incident.io/api-reference/alerts-v2/resolve](https://docs.incident.io/api-reference/alerts-v2/resolve)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

Unique identifier for the alert

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Respond to escalation

Action ID: `tools.incident_io.respond_to_escalation`

Respond to an escalation. Calls POST /v2/escalations/\{escalation\_id}/actions/respond directly. Requires API key scope: escalations.respond.

Reference: [https://docs.incident.io/api-reference/escalations-v2/respond](https://docs.incident.io/api-reference/escalations-v2/respond)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**escalation\_id** `string` *required*

The ID of the escalation

**response** `string` *required*

Whether to acknowledge, decline or snooze the escalation. Allowed values: `ack`, `nack`, `snooze`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**snooze\_details** `object | null`

`snooze_details` object. Fields: reason, snooze\_until.

Default: `null`.

## Set alert tags

Action ID: `tools.incident_io.set_alert_tags`

Replace all tags on an alert. Calls POST /v2/alerts/\{id}/actions/set\_tags directly. Requires API key scope: alerts.edit.

Reference: [https://docs.incident.io/api-reference/alerts-v2/set-tags](https://docs.incident.io/api-reference/alerts-v2/set-tags)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

Unique identifier for the alert

**tags** `array[string]` *required*

The complete set of tag names for this alert

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Update action

Action ID: `tools.incident_io.update_action`

Update an existing incident action. Calls PUT /v3/actions/\{id} directly. Requires API key scope: actions.update.

Reference: [https://docs.incident.io/api-reference/actions-v3/update](https://docs.incident.io/api-reference/actions-v3/update)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**description** `string` *required*

Description of the action. Supports Markdown.

**id** `string` *required*

Unique identifier for the action

**status** `string` *required*

Status of the action. Setting this to `deleted` is not allowed; use the delete endpoint instead. Allowed values: `outstanding`, `completed`, `deleted`, `not_doing`.

**assignee\_id** `string | null`

ID of the user this action is assigned to. Set to null to unassign.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

## Update follow-up

Action ID: `tools.incident_io.update_follow_up`

Update an existing incident follow-up. Calls PUT /v3/follow\_ups/\{id} directly. Requires API key scope: follow\_ups.update.

Reference: [https://docs.incident.io/api-reference/follow-ups-v3/update](https://docs.incident.io/api-reference/follow-ups-v3/update)

### Secrets

Required secrets:

* `incident_io`: required values `INCIDENT_IO_API_KEY`.

### Input fields

**id** `string` *required*

Unique identifier for the follow-up

**status** `string` *required*

Status of the follow-up. Setting this to `deleted` is not allowed; use the delete endpoint instead. Allowed values: `outstanding`, `completed`, `deleted`, `not_doing`.

**title** `string` *required*

Title of the follow-up

**assignee\_id** `string | null`

ID of the user this follow-up is assigned to. Set to null to unassign.

Default: `null`.

**assignee\_team\_id** `string | null`

ID of the team this follow-up is assigned to. Set to null to unassign.

Default: `null`.

**base\_url** `string | null`

incident.io API base URL.

Default: `null`.

**description** `string | null`

Description of the follow-up. Supports Markdown.

Default: `null`.

**follow\_up\_category\_id** `string | null`

ID of the category for this follow-up

Default: `null`.

**follow\_up\_priority\_option\_id** `string | null`

ID of the priority for this follow-up

Default: `null`.

**labels** `array[string] | null`

Labels associated with this follow-up

Default: `null`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.