Get desktop application:
View/edit binary Protocol Buffers messages
The Incident API for Incident Response & Management.
Creates a new incident.
Request for the CreateIncident method.
The incident to create.
The resource name of the hosting Stackdriver project which the incident belongs to. The name is of the form `projects/{project_id_or_number}` .
Returns an incident by name.
Request for the GetIncident method.
Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
Returns a list of incidents. Incidents are ordered by start time, with the most recent incidents first.
Request for the SearchIncidents method.
The resource name of the hosting Stackdriver project which requested incidents belong to.
An expression that defines which incidents to return. Search atoms can be used to match certain specific fields. Otherwise, plain text will match text fields in the incident. Search atoms: * `start` - (timestamp) The time the incident started. * `stage` - The stage of the incident, one of detected, triaged, mitigated, resolved, documented, or duplicate (which correspond to values in the Incident.Stage enum). These are ordered, so `stage<resolved` is equivalent to `stage:detected OR stage:triaged OR stage:mitigated`. * `severity` - (Incident.Severity) The severity of the incident. + Supports matching on a specific severity (for example, `severity:major`) or on a range (for example, `severity>medium`, `severity<=minor`, etc.). Timestamp formats: * yyyy-MM-dd - an absolute date, treated as a calendar-day-wide window. In other words, the "<" operator will match dates before that date, the ">" operator will match dates after that date, and the ":" or "=" operators will match the entire day. * Nd (for example, 7d) - a relative number of days ago, treated as a moment in time (as opposed to a day-wide span). A multiple of 24 hours ago (as opposed to calendar days). In the case of daylight savings time, it will apply the current timezone to both ends of the range. Note that exact matching (for example, `start:7d`) is unlikely to be useful because that would only match incidents created precisely at a particular instant in time. Examples: * `foo` - matches incidents containing the word "foo" * `"foo bar"` - matches incidents containing the phrase "foo bar" * `foo bar` or `foo AND bar` - matches incidents containing the words "foo" and "bar" * `foo -bar` or `foo AND NOT bar` - matches incidents containing the word "foo" but not the word "bar" * `foo OR bar` - matches incidents containing the word "foo" or the word "bar" * `start>2018-11-28` - matches incidents which started after November 11, 2018. * `start<=2018-11-28` - matches incidents which started on or before November 11, 2018. * `start:2018-11-28` - matches incidents which started on November 11, 2018. * `start>7d` - matches incidents which started after the point in time 7*24 hours ago * `start>180d` - similar to 7d, but likely to cross the daylight savings time boundary, so the end time will be 1 hour different from "now." * `foo AND start>90d AND stage<resolved` - unresolved incidents from the past 90 days containing the word "foo"
Number of incidents to return.
Page token from an earlier query, as returned in `next_page_token`.
The time zone name. It should be an IANA TZ name, such as "America/Los_Angeles". For more information, see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones. If no time zone is specified, the default is UTC.
Response for the SearchIncidents method.
Incidents.
Page token to fetch the next set of incidents.
Updates an existing incident.
Request for the UpdateIncident method.
The incident to update with the new values.
List of fields that should be updated.
Returns a list of incidents that are "similar" to the specified incident or signal. This functionality is provided on a best-effort basis and the definition of "similar" is subject to change.
Request for the SearchSimilarIncidents method.
Resource name of the incident or signal, for example, "projects/{project_id}/incidents/{incident_id}".
Number of similar incidents to return.
Page token from an earlier query, as returned in 'next_page_token'.
Response for the SearchSimilarIncidents method.
The search results, ordered by descending relevance.
Page token to fetch the next set of similar incidents.
Creates an annotation on an existing incident. Only 'text/plain' and 'text/markdown' annotations can be created via this method.
Request for the CreateAnnotation method.
Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
Only annotation.content is an input argument.
Lists annotations that are part of an incident. No assumptions should be made on the content-type of the annotation returned.
Request for the ListAnnotations method.
Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
Number of annotations to return.
Page token from an earlier query, as returned in `next_page_token`.
Response for the ListAnnotations method.
List of annotations.
Page token to fetch the next set of annotations.
Creates a tag on an existing incident.
Request for the CreateTag method.
Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
Tag to create. Only tag.display_name is an input argument.
Deletes an existing tag.
Request for the DeleteTag method.
Resource name of the tag.
Lists tags that are part of an incident.
Request for the ListTagsForIncident method.
Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
Number of tags to return.
Page token from an earlier query, as returned in `next_page_token`.
Response for the ListTagsForIncident method.
Tags.
Page token to fetch the next set of tags.
Creates a new signal.
Request for the CreateSignal method.
The resource name of the hosting Stackdriver project which requested signal belongs to.
The signal to create.
Lists signals that are part of an incident. Signals are returned in reverse chronological order.
Request for the SearchSignals method.
The resource name of the hosting Stackdriver project which requested incidents belong to.
An expression that defines which signals to return. Search atoms can be used to match certain specific fields. Otherwise, plain text will match text fields in the signal. Search atoms: * `start` - (timestamp) The time the signal was created. * `title` - The title of the signal. * `signal_state` - `open` or `closed`. State of the signal. (e.g., `signal_state:open`) Timestamp formats: * yyyy-MM-dd - an absolute date, treated as a calendar-day-wide window. In other words, the "<" operator will match dates before that date, the ">" operator will match dates after that date, and the ":" operator will match the entire day. * yyyy-MM-ddTHH:mm - Same as above, but with minute resolution. * yyyy-MM-ddTHH:mm:ss - Same as above, but with second resolution. * Nd (e.g. 7d) - a relative number of days ago, treated as a moment in time (as opposed to a day-wide span) a multiple of 24 hours ago (as opposed to calendar days). In the case of daylight savings time, it will apply the current timezone to both ends of the range. Note that exact matching (e.g. `start:7d`) is unlikely to be useful because that would only match signals created precisely at a particular instant in time. The absolute timestamp formats (everything starting with a year) can optionally be followed with a UTC offset in +/-hh:mm format. Also, the 'T' separating dates and times can optionally be replaced with a space. Note that any timestamp containing a space or colon will need to be quoted. Examples: * `foo` - matches signals containing the word "foo" * `"foo bar"` - matches signals containing the phrase "foo bar" * `foo bar` or `foo AND bar` - matches signals containing the words "foo" and "bar" * `foo -bar` or `foo AND NOT bar` - matches signals containing the word "foo" but not the word "bar" * `foo OR bar` - matches signals containing the word "foo" or the word "bar" * `start>2018-11-28` - matches signals which started after November 11, 2018. * `start<=2018-11-28` - matches signals which started on or before November 11, 2018. * `start:2018-11-28` - matches signals which started on November 11, 2018. * `start>"2018-11-28 01:02:03+04:00"` - matches signals which started after November 11, 2018 at 1:02:03 AM according to the UTC+04 time zone. * `start>7d` - matches signals which started after the point in time 7*24 hours ago * `start>180d` - similar to 7d, but likely to cross the daylight savings time boundary, so the end time will be 1 hour different from "now." * `foo AND start>90d AND stage<resolved` - unresolved signals from the past 90 days containing the word "foo"
Maximum number of `signals` to return in the response.
Page token from an earlier query, as returned in `next_page_token`. All field values except for page_size and page_token should be the same as the original query (may return an error or unexpected data otherwise).
Response for the SearchSignals method.
Signals that matched the query in the request.
Page token to fetch the next set of signals.
Finds a signal by other unique IDs.
Request for the LookupSignal method.
Required. The ID to use for lookup.
Full resource name of the CSCC finding id this signal refers to (e.g. "organizations/abc/sources/123/findings/xyz")
The ID from the Stackdriver Alerting notification.
Returns a signal by name.
Request for the GetSignal method.
Resource name of the Signal resource, for example, "projects/{project_id}/signals/{signal_id}".
Updates an existing signal (for example, to assign/unassign it to an incident).
Request for the UpdateSignal method.
The signal to update with the new values.
List of fields that should be updated.
Escalates an incident.
Request to escalate an incident.
The incident to escalate with the new values.
List of fields that should be updated.
Subscriptions to add or update. Existing subscriptions with the same channel and address as a subscription in the list will be updated.
Tags to add. Tags identical to existing tags will be ignored.
Roles to add or update. Existing roles with the same type (and title, for TYPE_OTHER roles) will be updated.
Artifacts to add. All artifacts are added without checking for duplicates.
Response for EscalateIncident.
The escalated incident.
New or modified subscriptions.
New or modified tags.
New or modified roles.
New or modified artifacts.
Creates a new artifact.
Request for the CreateArtifact method.
Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
The artifact to create.
Returns a list of artifacts for an incident.
Request for the ListArtifacts method.
Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
Number of artifacts to return.
Page token from an earlier query, as returned in `next_page_token`.
Response for the ListArtifacts method.
List of artifacts.
Page token to fetch the next set of artifacts.
Updates an existing artifact.
Request for the UpdateArtifact method.
The artifact to update with the new values.
List of fields that should be updated.
Deletes an existing artifact.
Request for deleting an artifact.
Resource name of the artifact.
Sends a summary of the shift for oncall handoff.
SendShiftHandoff and PreviewShiftHandoff RPC request.
The resource name of the Stackdriver project that the handoff is being sent from. for example, `projects/{project_id}`
Email addresses of the recipients of the handoff, for example, "user@example.com". Must contain at least one entry.
Email addresses that should be CC'd on the handoff. Optional.
The subject of the email. Required.
Content type string, for example, 'text/plain' or 'text/html'.
Additional notes to be included in the handoff. Optional.
The set of incidents that should be included in the handoff. Optional.
If set to true a ShiftHandoffResponse will be returned but the handoff will not actually be sent.
SendShiftHandoff and PreviewShiftHandoff RPC response.
Content type string, for example, 'text/plain' or 'text/html'.
The contents of the handoff that was sent or would have been sent (if the request was preview_only). This will typically contain a full HTML document.
Creates a new subscription. This will fail if: a. there are too many (50) subscriptions in the incident already b. a subscription using the given channel already exists
Request for the CreateSubscription method.
Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
The subscription to create.
Updates a subscription.
Request for the UpdateSubscription method.
The subscription to update, with new values.
List of fields that should be updated.
Returns a list of subscriptions for an incident.
Request for the ListSubscriptions method.
Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
Number of subscriptions to return.
Page token from an earlier query, as returned in `next_page_token`.
Response for the ListSubscriptions method.
List of subscriptions.
Page token to fetch the next set of subscriptions.
Deletes an existing subscription.
Request for deleting a subscription.
Resource name of the subscription.
Creates a role assignment on an existing incident. Normally, the user field will be set when assigning a role to oneself, and the next field will be set when proposing another user as the assignee. Setting the next field directly to a user other than oneself is equivalent to proposing and force-assigning the role to the user.
Request for creating a role assignment.
Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
Role assignment to create.
Deletes an existing role assignment.
Request for deleting a role assignment.
Resource name of the role assignment.
Lists role assignments that are part of an incident.
Request to list role assignments of an incident.
Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
Number of assignments to return.
Page token from an earlier query, as returned in `next_page_token`.
Response for the ListIncidentRoleAssignments method.
List of assignments.
Page token to fetch the next set of assignments.
Starts a role handover. The proposed assignee will receive an email notifying them of the assignment. This will fail if a role handover is already pending.
Request to start a role handover.
Resource name of the role assignment.
The proposed assignee.
Confirms a role handover. This will fail if the 'proposed_assignee' field of the IncidentRoleAssignment is not equal to the 'new_assignee' field of the request. If the caller is not the new_assignee, ForceIncidentRoleHandover should be used instead.
Request to confirm a role handover.
Resource name of the role assignment.
The proposed assignee, who will now be the assignee. This should be the current user; otherwise ForceRoleHandover should be called.
Forces a role handover. This will fail if the 'proposed_assignee' field of the IncidentRoleAssignment is not equal to the 'new_assignee' field of the request. If the caller is the new_assignee, ConfirmIncidentRoleHandover should be used instead.
Request to force a role handover.
Resource name of the role assignment.
The proposed assignee, who will now be the assignee. This should not be the current user; otherwise ConfirmRoleHandover should be called.
Cancels a role handover. This will fail if the 'proposed_assignee' field of the IncidentRoleAssignment is not equal to the 'new_assignee' field of the request.
Request to cancel a role handover.
Resource name of the role assignment.
Person who was proposed as the next assignee (i.e. IncidentRoleAssignment.proposed_assignee) and whose proposal is being cancelled.
A text annotation by a user.
Used as response type in: IncidentService.CreateAnnotation
Used as field type in:
,Resource name of the annotation, for example, "projects/{project_id}/incidents/{incident_id}/annotations/{annotation_id}".
Output only. Author of the annotation.
Output only. Time the annotation was created.
Content of the annotation. Immutable.
Content type of the annotation, for example, 'text/plain' or 'text/markdown'. Immutable.
External artifact associated to an incident.
Used as response type in: IncidentService.CreateArtifact, IncidentService.UpdateArtifact
Used as field type in:
, , , ,Output only. Resource name such as "projects/{project_id}/incidents/{incident_id}/artifacts/{artifact_id}".
User provided name of an artifact.
Output only. Etag for this version of the resource. Must be specified in update requests and match the current version in storage. Must not be modified by the client.
URL to access the artifact.
Type of this artifact.
Possible types of an artifact.
Used in:
External type is unspecified.
URL.
A JIRA issue.
Communication Channels are mechanisms used to receive notifications about changes to incidents.
Used in:
An endpoint describes how messages will be delivered.
Messages will be delivered via email.
Messages will be delivered via a Stackdriver notification channel.
A communication channel that delivers messages to an email address.
Used in:
The email address, for example, "user@example.com".
A communication channel that delivers messages to a Stackdriver notification channel.
Used in:
Stackdriver notification channel name.
Representation of an incident.
Used as response type in: IncidentService.CreateIncident, IncidentService.GetIncident, IncidentService.UpdateIncident
Used as field type in:
, , , , ,Output only. Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
One-line summary of the incident.
Escalation level of the incident.
Etag to validate the object is unchanged for a read-modify-write operation. An empty etag will overwrite other changes.
Severity of the incident.
Stage of the incident.
Resource name of the incident this incident is a duplicate of. Empty if this incident is not a duplicate. An incident can only be a duplicate of an incident that is not marked as a duplicate already. Setting this to a non-empty value must also set the stage to `STAGE_DUPLICATE`. Unsetting this value value must also update `stage` to a value other than `STAGE_DUPLICATE`.
Output only. Time this incident started. Used to measure the 'elapsed time'. Start time of an incident is the earliest creation time of any of its Signals or the create time of the incident if no Signals are assigned.
Output only. Synopsis of this incident.
Location of communications for this incident. This is informational only; IRM does not use this to send messages.
CommunicationVenue is a record of where conversations about an incident are happening.
Used in:
A URI to the web interface of the channel.
A name representing the channel in IRM UI.
The type of channel/venue for incident communications.
The type of channel/venue for incident communications.
Used in:
An unspecified communication channel.
A communication channel that is represented by a generic URI.
A communication channel that represents a Slack channel.
Specifies the escalation level of this incident, within the IRM protocol for handling incidents.
Used in:
The incident has not been escalated. This is the value used by all new and legacy incidents.
The incident has been escalated to the organizational level.
Severity of an incident.
Used in:
Severity is not specified.
Huge incident.
Major incident.
Medium incident.
Minor incident.
Negligible incident.
Stage of an incident.
Used in:
This is the default value if no stage has been specified. Note: The caller of the API should set the stage to DETECTED.
The incident has been detected. This is the initial stage of a new incident. Note: The caller still has to set the stage manually.
This incident has been formally characterized.
This incident has been mitigated, i.e. does not affect the service level anymore.
This incident has been fully resolved, i.e. there are no immediate follow-up tasks.
Postmortem for the incident was written.
Stage for an incident with `duplicate_incident`. This incident is not authoritative anymore and the `duplicate_incident` should be used to determine the stage.
Describes a role that can be assigned to an incident.
Used in:
,The type of role. The role type is immutable in role assignments. Each role type can only be used once per incident, except for TYPE_OTHER.
Output only unless TYPE_OTHER is used. Title of the role. For TYPE_OTHER, must be unique within an incident.
Output only unless TYPE_OTHER is used. Description of the role.
List of possible roles.
Used in:
The role is unspecified.
Incident Commander: Manages response plan, near-term and long-term objectives, establishes priorities, and delegates tasks as needed.
Communications Lead: Keeps everybody outside and within the response team informed.
Operations Lead: Figures out what to do, and gets it done.
External Customer Communications Lead: Responsible for communicating incident details to customers/public.
Primary Oncall: Responds to the initial page and handles all responsibilities for pre-escalated incidents.
Secondary Oncall: Helps the primary oncall if necessary; mostly useful for pre-escalated incidents.
User-specified roles. One example is a Planning Lead, who keeps track of the incident. Another is an assistant Incident Commander.
Stores the assignee of a role as well as the proposed next assignee.
Used as response type in: IncidentService.CancelIncidentRoleHandover, IncidentService.ConfirmIncidentRoleHandover, IncidentService.CreateIncidentRoleAssignment, IncidentService.ForceIncidentRoleHandover, IncidentService.RequestIncidentRoleHandover
Used as field type in:
, ,Output only. Resource name such as "projects/{project_id}/incidents/{incident_id}/role_assignments/{role_id}".
Output only. Etag for this version of the resource. Must be specified in update requests and match the current version in storage. Must not be modified by the client.
The role that is or will be assigned.
The user this role is assigned to. This field can only be directly set during creation request. Subsequent updates are done via the IncidentRoleHandover methods.
The recipient of a requested role handoff. This field can only be directly set during creation request. Subsequent updates are done via the IncidentRoleHandover methods. `assignee` is always the current role-holder, and `proposed_assignee` is used to track unfinished assignments and handoffs. Let's say Bob assigns Alice to a role. Then the fields are: `assignee`: nil, `proposed_assignee`: Alice If Alice accepts, then the fields are: `assignee`: Alice, `proposed_assignee`: nil If she cancels, then the RoleAssignment is deleted. Let's say Alice has the role. Then the fields are: `assignee`: Alice, `proposed_assignee`: nil If Alice becomes incapacitated and Bob requests Carol to take over, then the fields are: `assignee`: Alice, `proposed_assignee`: Carol After Carol accepts the handover, the fields are: `assignee`: Carol, `proposed_assignee`: nil Or if Carol refuses the handover, the fields are: `assignee`: Alice, `proposed_assignee`: nil
A single search result, i.e. an incident with (potentially) additional information.
Used in:
An incident that is "similar" to the incident or signal specified in the request.
Describes an incident for inclusion in the handoff. This is wrapped in a message to provide flexibility for potentially attaching additional data to each incident in the future.
Used in:
Resource name of the incident, for example, "projects/{project_id}/incidents/{incident_id}".
A signal is a message calling attention to a (potential) incident. An example is a page based on a Stackdriver Alerting policy.
Used as response type in: IncidentService.CreateSignal, IncidentService.GetSignal, IncidentService.LookupSignal, IncidentService.UpdateSignal
Used as field type in:
, ,Resource name of the signal, for example, "projects/{project_id}/signals/{signal_id}".
Etag to validate the object is unchanged for a read-modify-write operation. An empty etag will overwrite other changes.
Resource name of the incident this signal is currently assigned to. May be empty if signal is unassigned.
Output only. Time this signal was created.
Output only. Time this signal was closed. This field is not populated while the signal is still firing.
The time this Signal was first detected. This is identical to create_time for Signals created by Stackdriver Alerting.
Output only. The user that created this signal for manually created signals. Empty if this signal was generated by a system (for example, Stackdriver Alerting).
One-line summary of the signal. Immutable.
Content type string. 'text/plain' is currently the only supported content type for Signals created via the API. Signals created by Stackdriver Alerting support 'text/html' as well. Immutable for Signals created by Stackdriver Alerting.
Full message of the signal. Immutable for Signals created by Stackdriver Alerting.
The state of this signal. For Signals created by Stackdriver Alerting this field is output only.
A set of artifacts to additional resources for this Signal. For example, a link to Stackdriver logging for the Signal. Immutable for Signals created by Stackdriver Alerting.
An artifact associated with the Signal.
Used in:
The type of resource linked to
A custom user type
The URI for the artifact.
Describes whether the alerting condition is still firing.
Used in:
Unspecified
Firing
Non-firing
A subscription allows users to get notifications about changes to an incident.
Used as response type in: IncidentService.CreateSubscription, IncidentService.UpdateSubscription
Used as field type in:
, , , ,Output only. Resource name such as "projects/{project_id}/incidents/{incident_id}/subscriptions/{subscription_id}".
Output only. Etag for this version of the resource. Must be specified in update requests and match the current version in storage. Must not be modified by the client.
A communications channel to send subscription messages to.
Types of events this subscription receives notifications for.
Types of changes that users can subscribe to in an incident.
Used in:
An event_type that's not specified is an error.
The incident's title has changed.
The incident's synopsis has changed.
The incident's stage has changed.
The incident's severity has changed.
A new annotation has been added to the incident.
An annotation has been modified.
Synopsis is a summary of an incident and it contains a textual content, an author and a last updated timestamp.
Used in:
Content type string, for example, 'text/plain' or 'text/markdown'.
Textual content of the synopsis. It can be plain text or markdown as indicated by the content_type.
Last updated timestamp.
Author of the synopsis.
A tag by a user.
Used as response type in: IncidentService.CreateTag
Used as field type in:
, , ,Resource name of a tag, for example, "projects/{project_id}/incidents/{incident_id}/tags/{tag_id}"
Display name of the resource (for example, "cause:rollout"). Immutable.
A user of the IRM app.
Used in:
, , , , , , ,One of several ways to uniquely identify a user.
Output only. User id that will allow to get additional information from People API. This field will be populated implicitly if the caller creates or edits a resource (for example, posts an annotation).
Email address of the user. This must be associated with a Google account. This field will be set if the user is explicitly identified (verbatim) by email address in an API request (potentially sometime in the past). It will not be populated based on the credentials of a caller of the API.