Incidents

findIncident returns an Incident union — one of five types, all sharing a common set of fields. See Incidents for what each incident type means. Each type's payload field is either SiteWhoisPayload or SiteSSLPayload — see Types — or UptimeLinkRecordRoot, which shares its fields (location, spendTime, page, uptimeLinkSnapshot) with Uptime: findUptimeLinkRecord's response.

Common Fields

Field	Type	Description
`id`	`ID!`	Unique identifier for the incident.
`category`	`IncidentCategory!`	`UPTIME`, `SSL`, or `DOMAIN`.
`type`	`IncidentType!`	The specific incident type.
`level`	`IncidentLevel!`	Severity level.
`severity`	`Int!`	Numeric severity/priority score, mainly useful for sorting and the `SEVERITY` filter — higher generally means more urgent. Derived internally from `level`; use `level` for the human-readable severity.
`startTime`	`String!`	ISO 8601 timestamp when the incident opened.
`occurrence`	`Int!`	Number of times this condition has been observed.
`resolveTime`	`String`	ISO 8601 timestamp when the incident resolved. `null` while still open.
`duration`	`Int`	Duration of the incident in seconds, once resolved.
`domain` / `rootDomain`	`String`	The affected domain, if applicable.
`description`	`String`	Free-text note, settable via `updateIncident`.
`createNotifiedAt`	`String`	ISO 8601 timestamp when the create-notification was sent. `null` if not yet sent.
`resolveNotifiedAt`	`String`	ISO 8601 timestamp when the resolve-notification was sent. `null` if not yet sent.
`createTime` / `updateTime`	`String!` / `String`	ISO 8601 timestamps for creation / last update.

Incident Types

enum IncidentType {
  SSL_EXPIRATION
  SSL_CHECK
  DOMAIN_EXPIRATION
  DOMAIN_SUSPENDED
  UPTIME_STATUS_CODE
  UPTIME_TIMEOUT
  UPTIME_KEYWORD_MATCH
  UPTIME_TOO_MANY_REDIRECTS
  UPTIME_SSL
  UPTIME_CONNECTION
  UPTIME_REQUEST
  UPTIME_UNEXPECTED
}

`SiteDomainExpirationIncident`

Field	Type	Description
`siteId`	`ID!`	ID of the affected site.
`threshold`	`Int!`	Days-before-expiration threshold that triggered this incident.
`payload`	`SiteWhoisPayload`	Data from the most recent successful WHOIS lookup; may predate a later escalation of this incident if a subsequent lookup failed to refresh it.
`error`	`SiteWhoisError`	Always `null` — WHOIS lookup failures skip incident creation/escalation entirely.

`SiteDomainSuspendedIncident`

Field	Type	Description
`siteId`	`ID!`	ID of the affected site.
`payload`	`SiteWhoisPayload`	The WHOIS data at the time of the incident.
`error`	`SiteWhoisError`	Always `null` — domain-suspended incidents are only created from a successful WHOIS lookup.

`SiteSslCheckIncident`

Field	Type	Description
`siteId`	`ID!`	ID of the affected site.
`payload`	`SiteSSLPayload`	The SSL check data at the time of the incident.
`error`	`SiteSslError`	Set if the SSL check itself failed.

`SiteSslExpirationIncident`

Field	Type	Description
`siteId`	`ID!`	ID of the affected site.
`threshold`	`Int!`	Days-before-expiration threshold that triggered this incident.
`payload`	`SiteSSLPayload`	Data from the most recent successful SSL check; may predate a later escalation of this incident if a subsequent check failed to refresh it.
`error`	`SiteSslError`	Always `null` — SSL-check failures are reported via `SiteSslCheckIncident` instead.

`UptimeIncident`

Field	Type	Description
`uptimeLinkId`	`ID!`	ID of the affected uptime monitor.
`payload`	`UptimeLinkRecordRoot`	The check result that triggered or is tied to this incident.
`error`	`UptimeError`	Set if the check itself failed.

Queries

`findIncident`

Paginated, filterable list of incidents across your monitored sites and uptime monitors.

query {
  findIncident(query: "category = DOMAIN", limit: 25) {
    pagination {
      count
    }
    items {
      id
      type
      level
      domain
      startTime
      resolveTime
      ... on SiteDomainExpirationIncident {
        threshold
      }
    }
  }
}

Parameters

Name	Type	Description
`query`	`String`	Filter expression — see `IncidentFilterableFields`.
`page`	`Int`	Page number, defaults to 1.
`limit`	`Int`	Page size, defaults to 10, capped at 100.
`sort`	`[Sort!]`	Sort order, defaults to newest first.

Response: an IncidentList — pagination + items: [Incident!]!. Use inline fragments (... on SiteDomainExpirationIncident) to select type-specific fields. See Pagination & Sorting.

Mutations

`updateIncident`

Updates an incident's description.

mutation {
  updateIncident(id: "...", input: { description: "Investigating with the registrar" }) {
    id
    description
  }
}

Parameters

Name	Type	Description
`id`	`ID!`	The incident's ID.
`input`	`UpdateIncident!`	`{ description: String }` — free-text note to attach to the incident.

Response: the updated Incident.

Filterable Fields

IncidentFilterableFields — see Discovering Filterable Fields.

enum IncidentFilterableFields {
  ID
  SITE_ID
  UPTIME_LINK_ID
  DOMAIN
  ROOT_DOMAIN
  CATEGORY
  TYPE
  LEVEL
  OCCURRENCE
  START_TIME
  RESOLVE_TIME
  DURATION
  DESCRIPTION
  CREATE_TIME
  UPDATE_TIME
  SEVERITY
}

On this page