Get Incident

GET /api/incidents/

Retrieves comprehensive details about a specific incident, including suggestions, thoughts, citations, correlated alerts, and chat sessions.

Authentication

Requires user authentication via cookies or headers. The user_id is extracted from the request.

Path Parameters

incident_id

string

required

UUID of the incident to retrieve

Response

Returns an object containing the complete incident details.

incident

object

required

Show Incident Object

string

required

UUID of the incident

sourceType

string

required

Source monitoring platform (e.g., “grafana”, “datadog”, “netdata”)

sourceAlertId

string

required

ID of the alert in the source system

status

string

required

Current incident status: investigating, analyzed, merged, or resolved

severity

string

Severity level of the incident

alert

object

required

Alert information including title, service, source, sourceUrl, triggeredAt, rawPayload, and optional metadata

auroraStatus

string

required

RCA analysis status: idle, running, complete, or error

summary

string

Aurora’s investigation summary

chatSessionId

string

UUID of the primary RCA chat session

activeTab

string

Current active tab: thoughts or chat

correlatedAlertCount

integer

Number of correlated alerts

affectedServices

array

List of affected service names

mergedIntoIncidentId

string

UUID of target incident if this was merged

mergedIntoTitle

string

Title of the target incident

suggestions

array

required

Array of suggested actions or fixes

Show Suggestion Object

string

required

Suggestion ID

title

string

required

Suggestion title

description

string

Detailed description

type

string

Type: diagnostic or fix

risk

string

Risk level: safe, medium, or high

command

string

Command to execute (for diagnostic suggestions)

filePath

string

File path (for fix suggestions)

originalContent

string

Original file content (for fix suggestions)

suggestedContent

string

Suggested file content (for fix suggestions)

userEditedContent

string

User-edited content (for fix suggestions)

repository

string

GitHub repository (for fix suggestions)

prUrl

string

Pull request URL (for applied fix suggestions)

prNumber

integer

Pull request number (for applied fix suggestions)

createdBranch

string

Git branch created (for fix suggestions)

appliedAt

string

ISO 8601 timestamp when fix was applied

createdAt

string

required

ISO 8601 timestamp when suggestion was created

streamingThoughts

array

required

Array of investigation thoughts in chronological order

Show Thought Object

string

required

Thought ID

timestamp

string

required

ISO 8601 timestamp

content

string

required

Thought content

type

string

Thought type (e.g., “analysis”)

createdAt

string

required

ISO 8601 timestamp

citations

array

required

Array of command executions referenced in the investigation

Show Citation Object

string

required

Citation ID

key

string

required

Citation reference key (e.g., “1”, “2”)

toolName

string

required

Name of the tool executed

command

string

Command that was executed

output

string

Output from the command

executedAt

string

ISO 8601 timestamp when command was executed

createdAt

string

required

ISO 8601 timestamp

correlatedAlerts

array

required

Array of alerts correlated to this incident

Show Correlated Alert Object

string

required

Alert ID

sourceType

string

required

Source monitoring platform

alertTitle

string

required

Alert title

alertService

string

Affected service

alertSeverity

string

Alert severity level

correlationStrategy

string

required

Strategy used for correlation (e.g., “primary”, “service”, “time_window”, “manual”)

correlationScore

number

required

Correlation confidence score (0.0 to 1.0)

correlationDetails

object

Additional correlation metadata

receivedAt

string

required

ISO 8601 timestamp when alert was received

chatSessions

array

required

Array of chat sessions linked to this incident

Show Chat Session Object

string

required

Session ID

title

string

required

Session title

messages

array

required

Array of chat messages

status

string

Session status (e.g., “active”, “in_progress”, “completed”)

createdAt

string

required

ISO 8601 timestamp

updatedAt

string

required

ISO 8601 timestamp

startedAt

string

required

ISO 8601 timestamp

analyzedAt

string

ISO 8601 timestamp

createdAt

string

required

ISO 8601 timestamp

updatedAt

string

required

ISO 8601 timestamp

Example Request

cURL

curl -X GET "https://api.aurora.example.com/api/incidents/123e4567-e89b-12d3-a456-426614174000" \
  -H "Cookie: session_token=YOUR_SESSION_TOKEN"

Example Response

{
  "incident": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "sourceType": "grafana",
    "sourceAlertId": "12345",
    "status": "investigating",
    "severity": "critical",
    "alert": {
      "title": "High CPU usage on web-server-01",
      "service": "web-server",
      "source": "grafana",
      "sourceUrl": "https://grafana.com/alerting/12345",
      "triggeredAt": "2024-03-03T10:30:00Z",
      "rawPayload": "{\"alertname\": \"HighCPU\", ...}",
      "metadata": {
        "threshold": "80%",
        "currentValue": "95%"
      }
    },
    "auroraStatus": "complete",
    "summary": "CPU spike caused by memory leak in payment-service v2.3.1",
    "chatSessionId": "abc123-session-id",
    "activeTab": "thoughts",
    "correlatedAlertCount": 2,
    "affectedServices": ["web-server", "payment-service"],
    "suggestions": [
      {
        "id": "1",
        "title": "Check recent deployments",
        "description": "Review recent changes to identify potential causes",
        "type": "diagnostic",
        "risk": "safe",
        "command": "kubectl rollout history deployment/web-server",
        "createdAt": "2024-03-03T10:31:00Z"
      }
    ],
    "streamingThoughts": [
      {
        "id": "1",
        "timestamp": "2024-03-03T10:30:15Z",
        "content": "Analyzing CPU metrics...",
        "type": "analysis",
        "createdAt": "2024-03-03T10:30:15Z"
      }
    ],
    "citations": [
      {
        "id": "1",
        "key": "1",
        "toolName": "kubectl",
        "command": "kubectl top pod",
        "output": "NAME                    CPU(cores)   MEMORY(bytes)\nweb-server-01           950m         2048Mi",
        "executedAt": "2024-03-03T10:30:20Z",
        "createdAt": "2024-03-03T10:30:20Z"
      }
    ],
    "correlatedAlerts": [
      {
        "id": "alert-uuid-1",
        "sourceType": "datadog",
        "alertTitle": "High memory usage on web-server-01",
        "alertService": "web-server",
        "alertSeverity": "warning",
        "correlationStrategy": "service",
        "correlationScore": 0.85,
        "correlationDetails": {
          "matchedField": "service"
        },
        "receivedAt": "2024-03-03T10:31:00Z"
      }
    ],
    "chatSessions": [
      {
        "id": "session-uuid-1",
        "title": "RCA: High CPU usage",
        "messages": [],
        "status": "completed",
        "createdAt": "2024-03-03T10:30:00Z",
        "updatedAt": "2024-03-03T10:45:00Z"
      }
    ],
    "startedAt": "2024-03-03T10:30:00Z",
    "analyzedAt": "2024-03-03T10:45:00Z",
    "createdAt": "2024-03-03T10:30:05Z",
    "updatedAt": "2024-03-03T10:45:00Z"
  }
}

Response Codes

200

Success

Successfully retrieved incident details

400

Bad Request

Missing user_id (authentication failed)
Invalid incident ID format (not a valid UUID)

404

Not Found

Incident not found or does not belong to the authenticated user

500

Internal Server Error

Failed to retrieve incident

Notes

The rawPayload field contains the complete original alert payload from the monitoring platform
Citations are filtered to only include numeric keys and ordered by citation key
Chat sessions are filtered to only include active sessions
Requires Row Level Security (RLS) context to be set with the user’s ID
All timestamps are in ISO 8601 format with UTC timezone

Authentication

Incidents

Chat Sessions

Connectors

Health & Monitoring

GET /api/incidents/

Authentication

Path Parameters

Response

Example Request

Example Response

Response Codes

Notes

Build docs developers (and LLMs) love

Authentication

Incidents

Chat Sessions

Connectors

Health & Monitoring

​GET /api/incidents/

​Authentication

​Path Parameters

​Response

​Example Request

​Example Response

​Response Codes

​Notes

Build docs developers (and LLMs) love

GET /api/incidents/

Authentication

Path Parameters

Response

Example Request

Example Response

Response Codes

Notes