> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/Arvo-AI/aurora/llms.txt
> Use this file to discover all available pages before exploring further.

# List Incidents

> Retrieve all incidents for the authenticated user

## GET /api/incidents

Retrieves all incidents for the current user. Returns incidents in reverse chronological order (most recent first), excluding merged incidents.

### Authentication

Requires user authentication via cookies or headers. The `user_id` is extracted from the request.

### Query Parameters

This endpoint does not accept query parameters. Results are limited to 100 incidents.

### Response

Returns an object containing an array of incident objects.

<ResponseField name="incidents" type="array">
  Array of incident objects

  <Expandable title="Incident Object">
    <ResponseField name="id" type="string" required>
      UUID of the incident
    </ResponseField>

    <ResponseField name="sourceType" type="string" required>
      Source of the alert (e.g., "grafana", "datadog", "netdata", "pagerduty", "splunk", "jenkins", "cloudbees", "dynatrace")
    </ResponseField>

    <ResponseField name="sourceAlertId" type="string" required>
      ID of the alert in the source system
    </ResponseField>

    <ResponseField name="status" type="string" required>
      Current status of the incident. Possible values: `investigating`, `analyzed`, `merged`, `resolved`
    </ResponseField>

    <ResponseField name="severity" type="string">
      Severity level of the incident (e.g., "critical", "warning", "info")
    </ResponseField>

    <ResponseField name="alert" type="object" required>
      Alert information

      <Expandable title="Alert Object">
        <ResponseField name="title" type="string" required>
          Title of the alert
        </ResponseField>

        <ResponseField name="service" type="string" required>
          Service affected by the alert
        </ResponseField>

        <ResponseField name="source" type="string" required>
          Source system for the alert
        </ResponseField>

        <ResponseField name="sourceUrl" type="string">
          URL to view the alert in the source system
        </ResponseField>

        <ResponseField name="metadata" type="object">
          Additional metadata about the alert (JSONB)
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="auroraStatus" type="string" required>
      Status of Aurora's RCA analysis. Possible values: `idle`, `running`, `complete`, `error`
    </ResponseField>

    <ResponseField name="summary" type="string">
      Aurora's summary of the incident investigation
    </ResponseField>

    <ResponseField name="chatSessionId" type="string">
      ID of the chat session for RCA investigation (UUID)
    </ResponseField>

    <ResponseField name="activeTab" type="string">
      Currently active tab in the UI. Possible values: `thoughts`, `chat`
    </ResponseField>

    <ResponseField name="correlatedAlertCount" type="integer">
      Number of alerts correlated to this incident
    </ResponseField>

    <ResponseField name="affectedServices" type="array">
      List of services affected by correlated alerts
    </ResponseField>

    <ResponseField name="mergedIntoIncidentId" type="string">
      If this incident was merged, the UUID of the target incident
    </ResponseField>

    <ResponseField name="mergedIntoTitle" type="string">
      Title of the incident this was merged into
    </ResponseField>

    <ResponseField name="startedAt" type="string" required>
      ISO 8601 timestamp when the incident started
    </ResponseField>

    <ResponseField name="analyzedAt" type="string">
      ISO 8601 timestamp when the incident was analyzed
    </ResponseField>

    <ResponseField name="createdAt" type="string" required>
      ISO 8601 timestamp when the incident record was created
    </ResponseField>

    <ResponseField name="updatedAt" type="string" required>
      ISO 8601 timestamp when the incident was last updated
    </ResponseField>
  </Expandable>
</ResponseField>

### Example Request

```bash cURL theme={null}
curl -X GET "https://api.aurora.example.com/api/incidents" \
  -H "Cookie: session_token=YOUR_SESSION_TOKEN"
```

### Example Response

```json theme={null}
{
  "incidents": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "sourceType": "grafana",
      "sourceAlertId": "12345",
      "status": "investigating",
      "severity": "critical",
      "alert": {
        "title": "High CPU usage on web-server-01",
        "service": "web-server",
        "source": "grafana",
        "sourceUrl": "https://grafana.com/alerting/12345",
        "metadata": {
          "threshold": "80%",
          "currentValue": "95%"
        }
      },
      "auroraStatus": "running",
      "summary": "Investigating high CPU usage...",
      "chatSessionId": "abc123-session-id",
      "activeTab": "thoughts",
      "correlatedAlertCount": 3,
      "affectedServices": ["web-server", "api-gateway"],
      "startedAt": "2024-03-03T10:30:00Z",
      "analyzedAt": null,
      "createdAt": "2024-03-03T10:30:05Z",
      "updatedAt": "2024-03-03T10:45:00Z"
    }
  ]
}
```

### Response Codes

<ResponseField name="200" type="Success">
  Successfully retrieved incidents
</ResponseField>

<ResponseField name="400" type="Bad Request">
  Missing user\_id (authentication failed)
</ResponseField>

<ResponseField name="500" type="Internal Server Error">
  Failed to retrieve incidents
</ResponseField>

### Notes

* Results are limited to 100 most recent incidents
* Incidents with status `merged` are excluded from results
* Results are ordered by `started_at` in descending order (most recent first)
* Requires Row Level Security (RLS) context to be set with the user's ID