Incidents

An incident is the Ops unit of work. Summaries, log queries, and post-mortems attach to it. The timeline is append-only.

Open

POST /v1/ops/incidents
Authorization: Bearer eridian_sk_...
Content-Type: application/json
Idempotency-Key: inc-2847-open

{
  "project_id": "prj_ops_001",
  "service_id": "svc_payments_api",
  "severity": "sev1",
  "title": "payments-api 5xx > 5% for 10m",
  "started_at": 1718400000,
  "model": "auto",
  "summarize": true,
  "sources": {
    "pagerduty_id": "PD-20491",
    "datadog_url": "https://app.datadoghq.com/incidents/..."
  }
}

severity is sev1 | sev2 | sev3 | sev4. Required scope: ops:write.

Summarize

If you opened with summarize: false, or you need a refresh:

POST /v1/ops/incidents/inc_2847/summarize
Authorization: Bearer eridian_sk_...

{
  "model": "auto",
  "window_minutes": 30,
  "include": ["logs", "metrics", "deploys", "prior_incidents"]
}

{
  "id": "ism_2847_02",
  "object": "eridian.ops.incident.summary",
  "model": "gemini",
  "likely_cause": "Ledger p95 > 2s after deploy 2.4.1.",
  "evidence": [
    { "type": "log", "query_id": "logq_91", "citation": "payments-api timeout count spike 14:02Z" },
    { "type": "deploy", "sha": "8f3a2b1c", "at": 1718399400 }
  ],
  "uncertain": ["Whether AZ-b ledger replica is partitioned"],
  "eridian": { "route": "gemini", "region": "eu-west-1" }
}

Summaries must list evidence. If retrieval is empty, likely_cause is null and uncertain explains the gap. The model is not allowed to invent a deploy SHA.

Timeline

POST /v1/ops/incidents/inc_2847/events
Authorization: Bearer eridian_sk_...

{
  "kind": "mitigation",
  "body": "Pinned payments-api to AZ-a.",
  "actor_id": "usr_oncall"
}

Eridian also appends kind: summary when a summarize job completes. Timeline GET:

GET /v1/ops/incidents/inc_2847/events?starting_after=evt_ops_01

Close

POST /v1/ops/incidents/inc_2847/close

{
  "resolved_at": 1718403600,
  "resolution": "Rolled back 2.4.1. Ledger p95 restored."
}

Closing does not write the post-mortem. See Post-Mortems.

Pages and humans

The model does not page. Ops Integrations can open the incident from PagerDuty. Eridian will not acknowledge a PD incident unless you grant that action and, on Enterprise, mark it high_risk (dual control). Acknowledging is a human or a bot you own.

See On-Call and Ops API.