Incidents

findIncident returns an Incident union — one of five types, all implementing IncidentInterface, which holds the common fields. Select the common fields with ... on IncidentInterface and the type-specific ones with an inline fragment on the type. See Incidents for how incidents work in the dashboard. Types that have a payload field carry either SiteWhoisPayload or SiteSSLPayload — see Types — or UptimeLinkRecordRoot, which shares its fields (location, spendTime, page, uptimeLinkSnapshot) with Uptime: findUptimeLinkRecord's response.

Some features and limits mentioned on this page vary by plan. Visit our Pricing page to review the plans.

Common Fields

Field	Type	Description
`id`	`ID!`	Unique identifier for the incident.
`category`	`IncidentCategory!`	`UPTIME`, `SSL`, or `DOMAIN`.
`type`	`IncidentType!`	The specific incident type.
`level`	`IncidentLevel!`	Severity level.
`severity`	`Int!`	Numeric severity for sorting and the `SEVERITY` filter — higher means more urgent. Use `level` for the human-readable severity.
`startTime`	`String!`	ISO 8601 timestamp when the incident opened.
`occurrence`	`Int!`	Number of times this condition has been observed.
`resolveTime`	`String`	ISO 8601 timestamp when the incident resolved. `null` while still open.
`duration`	`Int`	Duration of the incident in seconds, once resolved.
`domain` / `rootDomain`	`String`	The affected domain, if applicable.
`description`	`String`	Free-text note, settable via `updateIncident`.
`createNotifiedTime`	`String`	ISO 8601 timestamp when the create-notification was sent. `null` if not yet sent.
`resolveNotifiedTime`	`String`	ISO 8601 timestamp when the resolve-notification was sent. `null` if not yet sent.
`createTime` / `updateTime`	`String!` / `String`	ISO 8601 timestamps for creation / last update.

Incident Types

Type	Category	Meaning
`SSL_EXPIRATION`	`SSL`	The certificate is close to expiring.
`SSL_CHECK`	`SSL`	The SSL check failed.
`DOMAIN_EXPIRATION`	`DOMAIN`	The domain registration is close to expiring.
`DOMAIN_SUSPENDED`	`DOMAIN`	The domain is in a suspended state, such as a registrar hold.
`UPTIME_STATUS_CODE`	`UPTIME`	The response status code was not in the accepted list.
`UPTIME_TIMEOUT`	`UPTIME`	The request timed out.
`UPTIME_KEYWORD_MATCH`	`UPTIME`	A required keyword was missing, or a forbidden keyword was found.
`UPTIME_TOO_MANY_REDIRECTS`	`UPTIME`	The request was redirected too many times.
`UPTIME_SSL`	`UPTIME`	An SSL/TLS error occurred during the check.
`UPTIME_CONNECTION`	`UPTIME`	The target could not be connected to, or the connection dropped mid-request.
`UPTIME_REQUEST`	`UPTIME`	The request was blocked, or the response was too large or malformed.
`UPTIME_UNEXPECTED`	`UPTIME`	An unexpected error occurred during the check.

`SiteDomainExpirationIncident`

Field	Type	Description
`siteId`	`ID!`	ID of the affected site.
`threshold`	`Int!`	Days-before-expiration threshold that triggered this incident.
`payload`	`SiteWhoisPayload`	Data from the latest successful WHOIS lookup.

`SiteDomainSuspendedIncident`

Field	Type	Description
`siteId`	`ID!`	ID of the affected site.
`payload`	`SiteWhoisPayload`	The WHOIS data at the time of the incident.

`SiteSslCheckIncident`

Field	Type	Description
`siteId`	`ID!`	ID of the affected site.
`error`	`SiteSslError`	The error that opened the incident.

`SiteSslExpirationIncident`

Field	Type	Description
`siteId`	`ID!`	ID of the affected site.
`threshold`	`Int!`	Days-before-expiration threshold that triggered this incident.
`payload`	`SiteSSLPayload`	Data from the latest successful SSL check.

`UptimeIncident`

Field	Type	Description
`uptimeLinkId`	`ID!`	ID of the affected uptime monitor.
`payload`	`UptimeLinkRecordRoot`	The check result that triggered or is tied to this incident.
`error`	`UptimeError`	The error that opened the incident.

Queries

`findIncident`

Paginated, filterable list of incidents across your monitored sites and uptime monitors.

query {
  findIncident(query: "category = DOMAIN", limit: 25) {
    pagination {
      count
    }
    items {
      ... on IncidentInterface {
        id
        type
        level
        domain
        startTime
        resolveTime
      }
      ... on SiteDomainExpirationIncident {
        threshold
      }
    }
  }
}

Parameters

Name	Type	Description
`query`	`String`	Filter expression — see Discovering Filterable Fields.
`page`	`Int`	Page number, defaults to 1.
`limit`	`Int`	Page size, defaults to 10, capped at 100.
`sort`	`[Sort!]`	Sort order, defaults to newest first.

Response: an IncidentList — pagination + items: [Incident!]!. Use ... on IncidentInterface for the common fields and inline fragments (... on SiteDomainExpirationIncident) for type-specific fields. See Pagination & Sorting.

Mutations

`updateIncident`

Updates an incident's description.

mutation {
  updateIncident(id: "...", input: { description: "Investigating with the registrar" }) {
    ... on IncidentInterface {
      id
      description
    }
  }
}

Parameters

Name	Type	Description
`id`	`ID!`	The incident's ID.
`input`	`UpdateIncident!`	`{ description: String }` — free-text note to attach to the incident.

Response: the updated Incident.

On this page