> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/Arvo-AI/aurora/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Incident

> Retrieve detailed information about a specific incident

## GET /api/incidents/{incident_id}

Retrieves comprehensive details about a specific incident, including suggestions, thoughts, citations, correlated alerts, and chat sessions.

### Authentication

Requires user authentication via cookies or headers. The `user_id` is extracted from the request.

### Path Parameters

<ParamField path="incident_id" type="string" required>
  UUID of the incident to retrieve
</ParamField>

### Response

Returns an object containing the complete incident details.

<ResponseField name="incident" type="object" required>
  <Expandable title="Incident Object">
    <ResponseField name="id" type="string" required>
      UUID of the incident
    </ResponseField>

    <ResponseField name="sourceType" type="string" required>
      Source monitoring platform (e.g., "grafana", "datadog", "netdata")
    </ResponseField>

    <ResponseField name="sourceAlertId" type="string" required>
      ID of the alert in the source system
    </ResponseField>

    <ResponseField name="status" type="string" required>
      Current incident status: `investigating`, `analyzed`, `merged`, or `resolved`
    </ResponseField>

    <ResponseField name="severity" type="string">
      Severity level of the incident
    </ResponseField>

    <ResponseField name="alert" type="object" required>
      Alert information including title, service, source, sourceUrl, triggeredAt, rawPayload, and optional metadata
    </ResponseField>

    <ResponseField name="auroraStatus" type="string" required>
      RCA analysis status: `idle`, `running`, `complete`, or `error`
    </ResponseField>

    <ResponseField name="summary" type="string">
      Aurora's investigation summary
    </ResponseField>

    <ResponseField name="chatSessionId" type="string">
      UUID of the primary RCA chat session
    </ResponseField>

    <ResponseField name="activeTab" type="string">
      Current active tab: `thoughts` or `chat`
    </ResponseField>

    <ResponseField name="correlatedAlertCount" type="integer">
      Number of correlated alerts
    </ResponseField>

    <ResponseField name="affectedServices" type="array">
      List of affected service names
    </ResponseField>

    <ResponseField name="mergedIntoIncidentId" type="string">
      UUID of target incident if this was merged
    </ResponseField>

    <ResponseField name="mergedIntoTitle" type="string">
      Title of the target incident
    </ResponseField>

    <ResponseField name="suggestions" type="array" required>
      Array of suggested actions or fixes

      <Expandable title="Suggestion Object">
        <ResponseField name="id" type="string" required>
          Suggestion ID
        </ResponseField>

        <ResponseField name="title" type="string" required>
          Suggestion title
        </ResponseField>

        <ResponseField name="description" type="string">
          Detailed description
        </ResponseField>

        <ResponseField name="type" type="string">
          Type: `diagnostic` or `fix`
        </ResponseField>

        <ResponseField name="risk" type="string">
          Risk level: `safe`, `medium`, or `high`
        </ResponseField>

        <ResponseField name="command" type="string">
          Command to execute (for diagnostic suggestions)
        </ResponseField>

        <ResponseField name="filePath" type="string">
          File path (for fix suggestions)
        </ResponseField>

        <ResponseField name="originalContent" type="string">
          Original file content (for fix suggestions)
        </ResponseField>

        <ResponseField name="suggestedContent" type="string">
          Suggested file content (for fix suggestions)
        </ResponseField>

        <ResponseField name="userEditedContent" type="string">
          User-edited content (for fix suggestions)
        </ResponseField>

        <ResponseField name="repository" type="string">
          GitHub repository (for fix suggestions)
        </ResponseField>

        <ResponseField name="prUrl" type="string">
          Pull request URL (for applied fix suggestions)
        </ResponseField>

        <ResponseField name="prNumber" type="integer">
          Pull request number (for applied fix suggestions)
        </ResponseField>

        <ResponseField name="createdBranch" type="string">
          Git branch created (for fix suggestions)
        </ResponseField>

        <ResponseField name="appliedAt" type="string">
          ISO 8601 timestamp when fix was applied
        </ResponseField>

        <ResponseField name="createdAt" type="string" required>
          ISO 8601 timestamp when suggestion was created
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="streamingThoughts" type="array" required>
      Array of investigation thoughts in chronological order

      <Expandable title="Thought Object">
        <ResponseField name="id" type="string" required>
          Thought ID
        </ResponseField>

        <ResponseField name="timestamp" type="string" required>
          ISO 8601 timestamp
        </ResponseField>

        <ResponseField name="content" type="string" required>
          Thought content
        </ResponseField>

        <ResponseField name="type" type="string">
          Thought type (e.g., "analysis")
        </ResponseField>

        <ResponseField name="createdAt" type="string" required>
          ISO 8601 timestamp
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="citations" type="array" required>
      Array of command executions referenced in the investigation

      <Expandable title="Citation Object">
        <ResponseField name="id" type="string" required>
          Citation ID
        </ResponseField>

        <ResponseField name="key" type="string" required>
          Citation reference key (e.g., "1", "2")
        </ResponseField>

        <ResponseField name="toolName" type="string" required>
          Name of the tool executed
        </ResponseField>

        <ResponseField name="command" type="string">
          Command that was executed
        </ResponseField>

        <ResponseField name="output" type="string">
          Output from the command
        </ResponseField>

        <ResponseField name="executedAt" type="string">
          ISO 8601 timestamp when command was executed
        </ResponseField>

        <ResponseField name="createdAt" type="string" required>
          ISO 8601 timestamp
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="correlatedAlerts" type="array" required>
      Array of alerts correlated to this incident

      <Expandable title="Correlated Alert Object">
        <ResponseField name="id" type="string" required>
          Alert ID
        </ResponseField>

        <ResponseField name="sourceType" type="string" required>
          Source monitoring platform
        </ResponseField>

        <ResponseField name="alertTitle" type="string" required>
          Alert title
        </ResponseField>

        <ResponseField name="alertService" type="string">
          Affected service
        </ResponseField>

        <ResponseField name="alertSeverity" type="string">
          Alert severity level
        </ResponseField>

        <ResponseField name="correlationStrategy" type="string" required>
          Strategy used for correlation (e.g., "primary", "service", "time\_window", "manual")
        </ResponseField>

        <ResponseField name="correlationScore" type="number" required>
          Correlation confidence score (0.0 to 1.0)
        </ResponseField>

        <ResponseField name="correlationDetails" type="object">
          Additional correlation metadata
        </ResponseField>

        <ResponseField name="receivedAt" type="string" required>
          ISO 8601 timestamp when alert was received
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="chatSessions" type="array" required>
      Array of chat sessions linked to this incident

      <Expandable title="Chat Session Object">
        <ResponseField name="id" type="string" required>
          Session ID
        </ResponseField>

        <ResponseField name="title" type="string" required>
          Session title
        </ResponseField>

        <ResponseField name="messages" type="array" required>
          Array of chat messages
        </ResponseField>

        <ResponseField name="status" type="string">
          Session status (e.g., "active", "in\_progress", "completed")
        </ResponseField>

        <ResponseField name="createdAt" type="string" required>
          ISO 8601 timestamp
        </ResponseField>

        <ResponseField name="updatedAt" type="string" required>
          ISO 8601 timestamp
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="startedAt" type="string" required>
      ISO 8601 timestamp
    </ResponseField>

    <ResponseField name="analyzedAt" type="string">
      ISO 8601 timestamp
    </ResponseField>

    <ResponseField name="createdAt" type="string" required>
      ISO 8601 timestamp
    </ResponseField>

    <ResponseField name="updatedAt" type="string" required>
      ISO 8601 timestamp
    </ResponseField>
  </Expandable>
</ResponseField>

### Example Request

```bash cURL theme={null}
curl -X GET "https://api.aurora.example.com/api/incidents/123e4567-e89b-12d3-a456-426614174000" \
  -H "Cookie: session_token=YOUR_SESSION_TOKEN"
```

### Example Response

```json theme={null}
{
  "incident": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "sourceType": "grafana",
    "sourceAlertId": "12345",
    "status": "investigating",
    "severity": "critical",
    "alert": {
      "title": "High CPU usage on web-server-01",
      "service": "web-server",
      "source": "grafana",
      "sourceUrl": "https://grafana.com/alerting/12345",
      "triggeredAt": "2024-03-03T10:30:00Z",
      "rawPayload": "{\"alertname\": \"HighCPU\", ...}",
      "metadata": {
        "threshold": "80%",
        "currentValue": "95%"
      }
    },
    "auroraStatus": "complete",
    "summary": "CPU spike caused by memory leak in payment-service v2.3.1",
    "chatSessionId": "abc123-session-id",
    "activeTab": "thoughts",
    "correlatedAlertCount": 2,
    "affectedServices": ["web-server", "payment-service"],
    "suggestions": [
      {
        "id": "1",
        "title": "Check recent deployments",
        "description": "Review recent changes to identify potential causes",
        "type": "diagnostic",
        "risk": "safe",
        "command": "kubectl rollout history deployment/web-server",
        "createdAt": "2024-03-03T10:31:00Z"
      }
    ],
    "streamingThoughts": [
      {
        "id": "1",
        "timestamp": "2024-03-03T10:30:15Z",
        "content": "Analyzing CPU metrics...",
        "type": "analysis",
        "createdAt": "2024-03-03T10:30:15Z"
      }
    ],
    "citations": [
      {
        "id": "1",
        "key": "1",
        "toolName": "kubectl",
        "command": "kubectl top pod",
        "output": "NAME                    CPU(cores)   MEMORY(bytes)\nweb-server-01           950m         2048Mi",
        "executedAt": "2024-03-03T10:30:20Z",
        "createdAt": "2024-03-03T10:30:20Z"
      }
    ],
    "correlatedAlerts": [
      {
        "id": "alert-uuid-1",
        "sourceType": "datadog",
        "alertTitle": "High memory usage on web-server-01",
        "alertService": "web-server",
        "alertSeverity": "warning",
        "correlationStrategy": "service",
        "correlationScore": 0.85,
        "correlationDetails": {
          "matchedField": "service"
        },
        "receivedAt": "2024-03-03T10:31:00Z"
      }
    ],
    "chatSessions": [
      {
        "id": "session-uuid-1",
        "title": "RCA: High CPU usage",
        "messages": [],
        "status": "completed",
        "createdAt": "2024-03-03T10:30:00Z",
        "updatedAt": "2024-03-03T10:45:00Z"
      }
    ],
    "startedAt": "2024-03-03T10:30:00Z",
    "analyzedAt": "2024-03-03T10:45:00Z",
    "createdAt": "2024-03-03T10:30:05Z",
    "updatedAt": "2024-03-03T10:45:00Z"
  }
}
```

### Response Codes

<ResponseField name="200" type="Success">
  Successfully retrieved incident details
</ResponseField>

<ResponseField name="400" type="Bad Request">
  * Missing user\_id (authentication failed)
  * Invalid incident ID format (not a valid UUID)
</ResponseField>

<ResponseField name="404" type="Not Found">
  Incident not found or does not belong to the authenticated user
</ResponseField>

<ResponseField name="500" type="Internal Server Error">
  Failed to retrieve incident
</ResponseField>

### Notes

* The `rawPayload` field contains the complete original alert payload from the monitoring platform
* Citations are filtered to only include numeric keys and ordered by citation key
* Chat sessions are filtered to only include active sessions
* Requires Row Level Security (RLS) context to be set with the user's ID
* All timestamps are in ISO 8601 format with UTC timezone