Update an incident (status / priority / assignee / comment)
PATCH/v2/incidents/:id
Applies partial updates to a single incident identified by its Display ID (XVA-<number>).
- status: client-facing status label. If the transition requires a comment and none is supplied, a fallback comment is auto-generated and attributed to the integration source.
- priority:
P0,P1orP2, the same vocabulary the read APIs return, so a value read from an alert can be written back without mapping. Case-sensitive exact match. - assignee_email: email of the new assignee, or
nullto unassign. Same semantics as the dedicated/assigneeroute, for playbooks that combine acknowledge-and-assign in one call. - comment: free-text comment attached to the incident.
- external_reference: optional
{ system, ticket_id, url }passed through to the changelog for correlation with your ticketing system.
Idempotent: an identical body against an unchanged incident returns a no-op success.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 429
- 503
Update applied. data contains the post-update incident snapshot.
Validation failure. See error.code (VALIDATION_ERROR, INVALID_STATUS_TRANSITION, COMMENT_REQUIRED, USER_NOT_FOUND, INVALID_DISPLAY_ID, BULK_ACTION_FIELD_MISMATCH, BULK_LIMIT_EXCEEDED).
UNAUTHORIZED: missing or invalid bearer token, or wrong token type for a write route.
Access denied. Possible codes are ACCESS_DENIED, TWO_WAY_DISABLED, MODULE_ACCESS_DENIED, INCIDENT_ARCHIVED, org/user inactive, or integration configuration inactive.
Target entity (or job) not found in the token's org tree.
RATE_LIMIT_EXCEEDED: the per-token budget is exhausted. Back off per the Retry-After header.
Response Headers
Seconds to wait before retrying.
INTEGRATION_PLATFORM_UNAVAILABLE or INTEGRATION_AUTH_UNAVAILABLE: transient upstream failure, safe to retry.