From 00800d8b6a5d7134013fb1fc65c45e337843976d Mon Sep 17 00:00:00 2001 From: debidong <1953531014@qq.com> Date: Sat, 26 Sep 2026 16:00:48 +0800 Subject: [PATCH 1/2] chore(deps): bump go-flashduty to v0.15.6 v0.15.6 adds AlertItem.detail_url. Regenerated alert command help so json and toon output of alert reads keeps the console URL. --- go.mod | 2 +- go.sum | 4 ++-- internal/cli/zz_generated_alerts.go | 3 +++ internal/cli/zz_generated_response_help.go | 6 +++--- skills/flashduty/reference/alert.md | 6 +++--- 5 files changed, 12 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index 1c08678..ccd36d7 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/flashcatcloud/flashduty-cli go 1.25.1 require ( - github.com/flashcatcloud/go-flashduty v0.15.5 + github.com/flashcatcloud/go-flashduty v0.15.6 github.com/mattn/go-runewidth v0.0.29 github.com/spf13/cobra v1.10.2 github.com/spf13/pflag v1.0.10 diff --git a/go.sum b/go.sum index b1e734d..8252c39 100644 --- a/go.sum +++ b/go.sum @@ -1,8 +1,8 @@ github.com/clipperhouse/uax29/v2 v2.2.0 h1:ChwIKnQN3kcZteTXMgb1wztSgaU+ZemkgWdohwgs8tY= github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= -github.com/flashcatcloud/go-flashduty v0.15.5 h1:ovhuVr+PyE/1XdsGiMnCTIyLXlaPwv3Yi81PbufgXQg= -github.com/flashcatcloud/go-flashduty v0.15.5/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk= +github.com/flashcatcloud/go-flashduty v0.15.6 h1:RLLsB3qNp6thDaLLgu2n6Dx2iBThl836gkmu+4UPbBk= +github.com/flashcatcloud/go-flashduty v0.15.6/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/mattn/go-runewidth v0.0.29 h1:3oGF3R/S2N9DQ3ptftzVIvg2eicmojCzlwBEmqEPDfQ= diff --git a/internal/cli/zz_generated_alerts.go b/internal/cli/zz_generated_alerts.go index 281da42..0293d00 100644 --- a/internal/cli/zz_generated_alerts.go +++ b/internal/cli/zz_generated_alerts.go @@ -394,6 +394,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le - data_source_type (string) — Deprecated: use 'integration_type' instead. Omitted when empty. - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - description (string) — Alert description. + - detail_url (string) — Console URL of this alert ('{console}/alert/detail/{alert_id}'). Empty when the deployment has no console base configured. - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - event_cnt (integer) — Total number of raw events received by this alert. - events (array) — Raw events of this alert. Omitted here; populated only by 'POST /incident/alert/list'. @@ -535,6 +536,7 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[]; - data_source_type (string) — Deprecated: use 'integration_type' instead. Omitted when empty. - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - description (string) — Alert description. + - detail_url (string) — Console URL of this alert ('{console}/alert/detail/{alert_id}'). Empty when the deployment has no console base configured. - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - event_cnt (integer) — Total number of raw events received by this alert. - events (array) — Raw events of this alert. Omitted here; populated only by 'POST /incident/alert/list'. @@ -708,6 +710,7 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[]; - data_source_type (string) — Deprecated: use 'integration_type' instead. Omitted when empty. - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - description (string) — Alert description. + - detail_url (string) — Console URL of this alert ('{console}/alert/detail/{alert_id}'). Empty when the deployment has no console base configured. - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - event_cnt (integer) — Total number of raw events received by this alert. - events (array) — Raw events of this alert. Omitted here; populated only by 'POST /incident/alert/list'. diff --git a/internal/cli/zz_generated_response_help.go b/internal/cli/zz_generated_response_help.go index f0339d2..4cdd5f2 100644 --- a/internal/cli/zz_generated_response_help.go +++ b/internal/cli/zz_generated_response_help.go @@ -35,9 +35,9 @@ var responseHelpBySDKMethod = map[string]string{ "Alerts.EventReadList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", "Alerts.ReadEventList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", "Alerts.ReadFeed": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID.\n - agent_session_id (string) — AI SRE session that produced the entry. Omitted when no agent wrote it.\n - created_at (string) (required) — Creation timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator_id (integer) (required) — Member ID of the creator. 0 for system-generated entries.\n - deleted_at (string) — Soft-delete time, Unix epoch milliseconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - detail (object) (required) — Type-specific payload; the concrete shape is determined by `type`. May be `null` for entries stored without detail.\n - comment (string) — Comment body.\n - in_secs (integer) — Window in seconds over which the state changes were counted. Omitted when zero.\n - max_changes (integer) — State-change count threshold that triggered flapping detection. Omitted when zero.\n - mute_secs (integer) — Mute duration in seconds. Omitted when zero.\n - owner_id (integer) — New owner member ID set on the target incident. Omitted when unchanged.\n - rule_id (string) — Silence rule ID that muted the alert. Omitted when empty.\n - rule_name (string) — Silence rule name, resolved at read time. Omitted when empty.\n - severity (string) — Severity level. [Ok, Critical, Warning, Info]\n - source_alert_id (string) — ID of the source alert that triggered the inhibition. Omitted when empty.\n - source_alert_title (string) — Title of the source alert, resolved at read time. Omitted when empty.\n - source_alerts (array) — Source alerts merged into the target incident. Omitted when empty.\n - alert_id (string) — Alert ID (ObjectID hex string).\n - title (string) — Alert title, resolved at read time. Omitted when empty.\n - status (string) — Severity level. [Ok, Critical, Warning, Info]\n - target_incident (object) — Incident the alerts were merged into. Omitted when not recorded.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - title (string) — New title set on the target incident. Omitted when unchanged.\n - ref_id (string) (required) — ObjectID of the alert this entry references.\n - type (string) (required) — Alert activity feed entry type. Each value identifies one alert lifecycle event; the matching `detail` payload shape is determined by this field. | Type | Meaning | |---|---| | `a_new` | Alert triggered by an incoming event. | | `a_update` | Alert severity or status changed on an incoming event. | | `a_comm` | Comment added on the alert. | | `a_merge` | Alert merged into an incident. | | `a_m_silence` | Alert muted by a silence rule. | | `a_m_inhibit` | Alert muted by an inhibit rule. | | `a_m_flapping` | Alert muted by flapping detection (historical data only; no longer produced). | | `a_ack` | Alert acknowledged (historical data only; alert-level acknowledgement has been removed). | | `a_unack` | Alert acknowledgement revoked (historical data only). | | `a_close` | Alert closed (historical data only; no longer produced). | [a_new, a_update, a_comm, a_merge, a_m_silence, a_m_inhibit, a_m_flapping, a_ack, a_unack, a_close]\n - updated_at (string) (required) — Last update timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - via (string) — Surface that wrote the entry on a user's behalf; currently only `ai_sre`. Omitted when a user created the entry directly.\n", - "Alerts.ReadInfo": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - account_id (integer) — Account ID.\n - alert_id (string) — Unique alert ID (ObjectID hex string).\n - alert_key (string) — Deduplication key.\n - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n - channel_id (integer) — ID of the channel the alert belongs to.\n - channel_name (string) — Display name of the channel.\n - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated: use `integration_id` instead.\n - data_source_name (string) — Deprecated: use `integration_name` instead.\n - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Alert description.\n - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) — Total number of raw events received by this alert.\n - events (array) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) — True if this alert has ever been silenced.\n - images (array) — Images attached to the alert.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - incident (object) — Associated incident, if any.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) — ID of the integration that produced this alert.\n - integration_name (string) — Display name of the integration.\n - integration_ref_id (string) — External reference ID of the integration.\n - integration_type (string) — Type/plugin key of the integration.\n - labels (object) — Label key-value pairs.\n - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) — Alert title.\n - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", - "Alerts.ReadList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) — Account ID.\n - alert_id (string) — Unique alert ID (ObjectID hex string).\n - alert_key (string) — Deduplication key.\n - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n - channel_id (integer) — ID of the channel the alert belongs to.\n - channel_name (string) — Display name of the channel.\n - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated: use `integration_id` instead.\n - data_source_name (string) — Deprecated: use `integration_name` instead.\n - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Alert description.\n - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) — Total number of raw events received by this alert.\n - events (array) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) — True if this alert has ever been silenced.\n - images (array) — Images attached to the alert.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - incident (object) — Associated incident, if any.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) — ID of the integration that produced this alert.\n - integration_name (string) — Display name of the integration.\n - integration_ref_id (string) — External reference ID of the integration.\n - integration_type (string) — Type/plugin key of the integration.\n - labels (object) — Label key-value pairs.\n - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) — Alert title.\n - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", - "Alerts.ReadListByIDs": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) — Account ID.\n - alert_id (string) — Unique alert ID (ObjectID hex string).\n - alert_key (string) — Deduplication key.\n - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n - channel_id (integer) — ID of the channel the alert belongs to.\n - channel_name (string) — Display name of the channel.\n - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated: use `integration_id` instead.\n - data_source_name (string) — Deprecated: use `integration_name` instead.\n - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Alert description.\n - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) — Total number of raw events received by this alert.\n - events (array) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) — True if this alert has ever been silenced.\n - images (array) — Images attached to the alert.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - incident (object) — Associated incident, if any.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) — ID of the integration that produced this alert.\n - integration_name (string) — Display name of the integration.\n - integration_ref_id (string) — External reference ID of the integration.\n - integration_type (string) — Type/plugin key of the integration.\n - labels (object) — Label key-value pairs.\n - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) — Alert title.\n - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", + "Alerts.ReadInfo": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - account_id (integer) — Account ID.\n - alert_id (string) — Unique alert ID (ObjectID hex string).\n - alert_key (string) — Deduplication key.\n - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n - channel_id (integer) — ID of the channel the alert belongs to.\n - channel_name (string) — Display name of the channel.\n - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated: use `integration_id` instead.\n - data_source_name (string) — Deprecated: use `integration_name` instead.\n - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Alert description.\n - detail_url (string) — Console URL of this alert (`{console}/alert/detail/{alert_id}`). Empty when the deployment has no console base configured.\n - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) — Total number of raw events received by this alert.\n - events (array) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) — True if this alert has ever been silenced.\n - images (array) — Images attached to the alert.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - incident (object) — Associated incident, if any.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) — ID of the integration that produced this alert.\n - integration_name (string) — Display name of the integration.\n - integration_ref_id (string) — External reference ID of the integration.\n - integration_type (string) — Type/plugin key of the integration.\n - labels (object) — Label key-value pairs.\n - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) — Alert title.\n - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", + "Alerts.ReadList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) — Account ID.\n - alert_id (string) — Unique alert ID (ObjectID hex string).\n - alert_key (string) — Deduplication key.\n - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n - channel_id (integer) — ID of the channel the alert belongs to.\n - channel_name (string) — Display name of the channel.\n - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated: use `integration_id` instead.\n - data_source_name (string) — Deprecated: use `integration_name` instead.\n - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Alert description.\n - detail_url (string) — Console URL of this alert (`{console}/alert/detail/{alert_id}`). Empty when the deployment has no console base configured.\n - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) — Total number of raw events received by this alert.\n - events (array) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) — True if this alert has ever been silenced.\n - images (array) — Images attached to the alert.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - incident (object) — Associated incident, if any.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) — ID of the integration that produced this alert.\n - integration_name (string) — Display name of the integration.\n - integration_ref_id (string) — External reference ID of the integration.\n - integration_type (string) — Type/plugin key of the integration.\n - labels (object) — Label key-value pairs.\n - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) — Alert title.\n - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", + "Alerts.ReadListByIDs": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) — Account ID.\n - alert_id (string) — Unique alert ID (ObjectID hex string).\n - alert_key (string) — Deduplication key.\n - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n - channel_id (integer) — ID of the channel the alert belongs to.\n - channel_name (string) — Display name of the channel.\n - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated: use `integration_id` instead.\n - data_source_name (string) — Deprecated: use `integration_name` instead.\n - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Alert description.\n - detail_url (string) — Console URL of this alert (`{console}/alert/detail/{alert_id}`). Empty when the deployment has no console base configured.\n - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) — Total number of raw events received by this alert.\n - events (array) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) — True if this alert has ever been silenced.\n - images (array) — Images attached to the alert.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - incident (object) — Associated incident, if any.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) — ID of the integration that produced this alert.\n - integration_name (string) — Display name of the integration.\n - integration_ref_id (string) — External reference ID of the integration.\n - integration_type (string) — Type/plugin key of the integration.\n - labels (object) — Label key-value pairs.\n - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) — Alert title.\n - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", "Alerts.ReadPipelineInfo": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator_id (integer) — Member ID who created the pipeline.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - integration_id (integer) — Integration ID this pipeline applies to.\n - rules (array) — Ordered list of processing rules.\n - if (array) — AND-filter list — the rule applies only when every condition matches. `null` or omitted means the rule applies to all events.\n - key (string) (required) — Field name to filter on. Use plain names for built-in alert fields (e.g. `alert_severity`, `alert_key`, `check`, `resource`, `service`, `cluster`) or the `labels.` prefix for custom alert labels (e.g. `labels.env`, `labels.region`).\n - oper (string) (required) — Filter operator. `IN` — value must match one of `vals`; `NOTIN` — value must not match any of `vals`. Supports regex patterns wrapped in `/pattern/`. [IN, NOTIN]\n - vals (array) (required) — List of values to match against. Each entry is a plain string or a `/regex/` pattern.\n - kind (string) (required) — Rule type. Rules run in array order; when the `if` condition matches, the event is processed according to `kind`. | Value | Meaning | |---|---| | `title_reset` | Rewrites the event title from the `settings.title` template. | | `description_reset` | Rewrites the event description from the `settings.description` template. | | `severity_reset` | Resets the event severity and status to `settings.severity` (`Critical`/`Warning`/`Info`). | | `alert_drop` | Discards the matching event outright; no alert is created. | | `alert_inhibit` | Discards the event (inhibition) when an active source alert matching `settings.source_filters` and correlated via `settings.equals` exists. | [title_reset, description_reset, severity_reset, alert_drop, alert_inhibit]\n - settings (object) — Kind-specific settings. Shape depends on `kind`: - `title_reset`: `{ \"title\": \"\" }` - `description_reset`: `{ \"description\": \"\" }` - `severity_reset`: `{ \"severity\": \"Critical\"|\"Warning\"|\"Info\" }` - `alert_drop`: `{}` (empty object) - `alert_inhibit`: `{ \"equals\": [\"\", ...], \"source_filters\": }`\n - description (string) — New description template.\n - equals (array) — Label keys whose values must be equal between the source and current alert for inhibition to apply.\n - severity (string) — Target severity level. [Critical, Warning, Info]\n - source_filters (array) — AND-filter list identifying the source alerts to inhibit — every condition must match.\n - key (string) (required) — Field name to filter on. Use plain names for built-in alert fields (e.g. `alert_severity`, `alert_key`, `check`, `resource`, `service`, `cluster`) or the `labels.` prefix for custom alert labels (e.g. `labels.env`, `labels.region`).\n - oper (string) (required) — Filter operator. `IN` — value must match one of `vals`; `NOTIN` — value must not match any of `vals`. Supports regex patterns wrapped in `/pattern/`. [IN, NOTIN]\n - vals (array) (required) — List of values to match against. Each entry is a plain string or a `/regex/` pattern.\n - title (string) — New title template. Supports Golang template syntax referencing alert fields.\n - status (string) — Pipeline status. Always `enabled` in these responses — deleted pipelines are filtered out. [enabled]\n - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - updated_by (integer) — Member ID who last updated the pipeline.\n", "Alerts.ReadPipelineList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator_id (integer) — Member ID who created the pipeline.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - integration_id (integer) — Integration ID this pipeline applies to.\n - rules (array) — Ordered list of processing rules.\n - if (array) — AND-filter list — the rule applies only when every condition matches. `null` or omitted means the rule applies to all events.\n - key (string) (required) — Field name to filter on. Use plain names for built-in alert fields (e.g. `alert_severity`, `alert_key`, `check`, `resource`, `service`, `cluster`) or the `labels.` prefix for custom alert labels (e.g. `labels.env`, `labels.region`).\n - oper (string) (required) — Filter operator. `IN` — value must match one of `vals`; `NOTIN` — value must not match any of `vals`. Supports regex patterns wrapped in `/pattern/`. [IN, NOTIN]\n - vals (array) (required) — List of values to match against. Each entry is a plain string or a `/regex/` pattern.\n - kind (string) (required) — Rule type. Rules run in array order; when the `if` condition matches, the event is processed according to `kind`. | Value | Meaning | |---|---| | `title_reset` | Rewrites the event title from the `settings.title` template. | | `description_reset` | Rewrites the event description from the `settings.description` template. | | `severity_reset` | Resets the event severity and status to `settings.severity` (`Critical`/`Warning`/`Info`). | | `alert_drop` | Discards the matching event outright; no alert is created. | | `alert_inhibit` | Discards the event (inhibition) when an active source alert matching `settings.source_filters` and correlated via `settings.equals` exists. | [title_reset, description_reset, severity_reset, alert_drop, alert_inhibit]\n - settings (object) — Kind-specific settings. Shape depends on `kind`: - `title_reset`: `{ \"title\": \"\" }` - `description_reset`: `{ \"description\": \"\" }` - `severity_reset`: `{ \"severity\": \"Critical\"|\"Warning\"|\"Info\" }` - `alert_drop`: `{}` (empty object) - `alert_inhibit`: `{ \"equals\": [\"\", ...], \"source_filters\": }`\n - description (string) — New description template.\n - equals (array) — Label keys whose values must be equal between the source and current alert for inhibition to apply.\n - severity (string) — Target severity level. [Critical, Warning, Info]\n - source_filters (array) — AND-filter list identifying the source alerts to inhibit — every condition must match.\n - title (string) — New title template. Supports Golang template syntax referencing alert fields.\n - status (string) — Pipeline status. Always `enabled` in these responses — deleted pipelines are filtered out. [enabled]\n - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - updated_by (integer) — Member ID who last updated the pipeline.\n", "Analytics.ByAccount": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - acknowledgement_pct (number) — Acknowledgement rate (%): acknowledged incidents ÷ total incidents × 100, rounded to two decimals and capped at 100; 0 when the bucket has no incidents.\n - channel_id (integer) — Channel ID, returned only when aggregating by channel (`/insight/channel`).\n - channel_name (string) — Channel name, returned when aggregating by channel; omitted when the name cannot be resolved.\n - hours (string) — Hour bucket when `split_hours` is enabled. `work` is Mon–Fri 08:00–19:00, `sleep` is daily 23:00–08:00, and `off` is everything else, all evaluated in the account timezone (`sleep` takes precedence over `work`). Omitted when `split_hours` is false. [work, sleep, off]\n - mean_seconds_to_ack (number) — Mean time to first acknowledgement in seconds; 0 when no incident in the bucket was acknowledged.\n - mean_seconds_to_close (number) — Mean time to close in seconds; 0 when no incident in the bucket was closed.\n - noise_reduction_pct (number) — Noise reduction ratio (%): 100 − incidents ÷ alert events × 100, rounded to two decimals; 0 when there is no alert-event data or alert events do not exceed incidents.\n - responder_id (integer) — Responder (person) ID, returned only when aggregating by responder (`/insight/responder`).\n - responder_name (string) — Responder name, returned when aggregating by responder; omitted when the name cannot be resolved.\n - team_id (integer) — Team ID, returned only when aggregating by team (`/insight/team`).\n - team_name (string) — Team name, returned when aggregating by team; omitted when the name cannot be resolved (e.g. team deleted).\n - total_alert_cnt (integer) — Total number of alerts.\n - total_alert_event_cnt (integer) — Total number of alert events.\n - total_engaged_seconds (integer) — Total engaged time in seconds: each incident contributes the sum of close time minus acknowledgement time across its acknowledged responders.\n - total_incident_cnt (integer) — Total number of incidents.\n - total_incidents_acknowledged (integer) — Incidents that were acknowledged at least once.\n - total_incidents_auto_closed (integer) — Incidents closed automatically because all alerts recovered.\n - total_incidents_closed (integer) — Incidents that are closed.\n - total_incidents_escalated (integer) — Incidents that were escalated at least once.\n - total_incidents_manually_closed (integer) — Incidents closed manually.\n - total_incidents_manually_escalated (integer) — Incidents escalated manually at least once.\n - total_incidents_reassigned (integer) — Incidents that were reassigned at least once.\n - total_incidents_timeout_closed (integer) — Incidents closed automatically on timeout.\n - total_incidents_timeout_escalated (integer) — Incidents escalated on timeout at least once.\n - total_interruptions (integer) — Total interruptions: notifications sent via app push, SMS, or voice call; consecutive notifications to the same responder within 60 seconds count as one.\n - total_notifications (integer) — Total number of notifications sent.\n - total_seconds_to_ack (integer) — Total time to first acknowledgement in seconds.\n - total_seconds_to_close (integer) — Total time to close in seconds.\n - ts (string) — Start of the aggregation bucket, Unix epoch seconds. Equals `start_time` when no `aggregate_unit` is given. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", diff --git a/skills/flashduty/reference/alert.md b/skills/flashduty/reference/alert.md index 7d2a81e..a00c144 100644 --- a/skills/flashduty/reference/alert.md +++ b/skills/flashduty/reference/alert.md @@ -78,7 +78,7 @@ List alert activity feed ### get Get alert detail -- response: single object (`data` unwrapped to the top level) — fields: account_id (integer); alert_id (string); alert_key (string); alert_severity (string); alert_status (string); channel_id (integer); channel_name (string); channel_status (string); created_at (string); data_source_id (integer); data_source_name (string); data_source_ref_id (string); data_source_type (string); deleted_at (string); description (string); end_time (string); event_cnt (integer); events (array); ever_muted (boolean); images (array); incident (object); integration_id (integer); integration_name (string); integration_ref_id (string); integration_type (string); labels (object); last_time (string); responder_email (string); responder_name (string); start_time (string); title (string); title_rule (string); updated_at (string) +- response: single object (`data` unwrapped to the top level) — fields: account_id (integer); alert_id (string); alert_key (string); alert_severity (string); alert_status (string); channel_id (integer); channel_name (string); channel_status (string); created_at (string); data_source_id (integer); data_source_name (string); data_source_ref_id (string); data_source_type (string); deleted_at (string); description (string); detail_url (string); end_time (string); event_cnt (integer); events (array); ever_muted (boolean); images (array); incident (object); integration_id (integer); integration_name (string); integration_ref_id (string); integration_type (string); labels (object); last_time (string); responder_email (string); responder_name (string); start_time (string); title (string); title_rule (string); updated_at (string) ### info Get alert detail @@ -98,12 +98,12 @@ List alerts - `--severity` string - `--since` string - `--until` string -- response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: account_id (integer); alert_id (string); alert_key (string); alert_severity (string); alert_status (string); channel_id (integer); channel_name (string); channel_status (string); created_at (string); data_source_id (integer); data_source_name (string); data_source_ref_id (string); data_source_type (string); deleted_at (string); description (string); end_time (string); event_cnt (integer); events (array); ever_muted (boolean); images (array); incident (object); integration_id (integer); integration_name (string); integration_ref_id (string); integration_type (string); labels (object); last_time (string); responder_email (string); responder_name (string); start_time (string); title (string); title_rule (string); updated_at (string) +- response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: account_id (integer); alert_id (string); alert_key (string); alert_severity (string); alert_status (string); channel_id (integer); channel_name (string); channel_status (string); created_at (string); data_source_id (integer); data_source_name (string); data_source_ref_id (string); data_source_type (string); deleted_at (string); description (string); detail_url (string); end_time (string); event_cnt (integer); events (array); ever_muted (boolean); images (array); incident (object); integration_id (integer); integration_name (string); integration_ref_id (string); integration_type (string); labels (object); last_time (string); responder_email (string); responder_name (string); start_time (string); title (string); title_rule (string); updated_at (string) ### list-by-ids [...] List alerts by IDs - `` (positional, required) stringSlice — Alert IDs (ObjectID hex strings) to fetch. -- response: `{items: [...], has_next_page, search_after_ctx, total}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); alert_id (string); alert_key (string); alert_severity (string); alert_status (string); channel_id (integer); channel_name (string); channel_status (string); created_at (string); data_source_id (integer); data_source_name (string); data_source_ref_id (string); data_source_type (string); deleted_at (string); description (string); end_time (string); event_cnt (integer); events (array); ever_muted (boolean); images (array); incident (object); integration_id (integer); integration_name (string); integration_ref_id (string); integration_type (string); labels (object); last_time (string); responder_email (string); responder_name (string); start_time (string); title (string); title_rule (string); updated_at (string) +- response: `{items: [...], has_next_page, search_after_ctx, total}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); alert_id (string); alert_key (string); alert_severity (string); alert_status (string); channel_id (integer); channel_name (string); channel_status (string); created_at (string); data_source_id (integer); data_source_name (string); data_source_ref_id (string); data_source_type (string); deleted_at (string); description (string); detail_url (string); end_time (string); event_cnt (integer); events (array); ever_muted (boolean); images (array); incident (object); integration_id (integer); integration_name (string); integration_ref_id (string); integration_type (string); labels (object); last_time (string); responder_email (string); responder_name (string); start_time (string); title (string); title_rule (string); updated_at (string) ### merge [...] Merge alerts into an incident From 604ea1111eda8ae618b7e907206938eafcfa4688 Mon Sep 17 00:00:00 2001 From: debidong <1953531014@qq.com> Date: Sat, 26 Sep 2026 16:35:35 +0800 Subject: [PATCH 2/2] chore(deps): bump go-flashduty to v0.15.7 AlertInfo now carries detail_url, so incident alerts keeps the console URL. Incident list and similar default columns also keep num and detail_url. --- go.mod | 2 +- go.sum | 4 ++-- internal/cli/fieldproject_test.go | 6 +++--- internal/cli/incident.go | 6 +++--- internal/cli/incident_summary_script_test.go | 2 +- internal/cli/zz_generated_incidents.go | 5 +++++ internal/cli/zz_generated_response_help.go | 10 +++++----- .../skilldoc/incident_projection_guidance_test.go | 6 +++--- skills/flashduty/reference/incident.md | 14 +++++++------- skills/flashduty/scripts/incident-summary.sh | 2 +- 10 files changed, 31 insertions(+), 26 deletions(-) diff --git a/go.mod b/go.mod index ccd36d7..16bc421 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/flashcatcloud/flashduty-cli go 1.25.1 require ( - github.com/flashcatcloud/go-flashduty v0.15.6 + github.com/flashcatcloud/go-flashduty v0.15.7 github.com/mattn/go-runewidth v0.0.29 github.com/spf13/cobra v1.10.2 github.com/spf13/pflag v1.0.10 diff --git a/go.sum b/go.sum index 8252c39..10a6dd0 100644 --- a/go.sum +++ b/go.sum @@ -1,8 +1,8 @@ github.com/clipperhouse/uax29/v2 v2.2.0 h1:ChwIKnQN3kcZteTXMgb1wztSgaU+ZemkgWdohwgs8tY= github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= -github.com/flashcatcloud/go-flashduty v0.15.6 h1:RLLsB3qNp6thDaLLgu2n6Dx2iBThl836gkmu+4UPbBk= -github.com/flashcatcloud/go-flashduty v0.15.6/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk= +github.com/flashcatcloud/go-flashduty v0.15.7 h1:3bnopTmY2w6zUbPSV2MpLrHdzl1fr3hEM3DDbbj4cOY= +github.com/flashcatcloud/go-flashduty v0.15.7/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/mattn/go-runewidth v0.0.29 h1:3oGF3R/S2N9DQ3ptftzVIvg2eicmojCzlwBEmqEPDfQ= diff --git a/internal/cli/fieldproject_test.go b/internal/cli/fieldproject_test.go index ee4f5a8..dc696bb 100644 --- a/internal/cli/fieldproject_test.go +++ b/internal/cli/fieldproject_test.go @@ -278,7 +278,7 @@ func TestIncidentListStructuredDefaultUsesCompactProjection(t *testing.T) { t.Fatalf("execCommandSplit: %v", err) } - assertProjectedJSONFields(t, out, []string{"incident_id", "title", "incident_severity", "progress", "start_time", "channel_id"}) + assertProjectedJSONFields(t, out, []string{"incident_id", "num", "title", "incident_severity", "progress", "start_time", "channel_id", "detail_url"}) if !strings.Contains(stderrText, "note: rows projected to default compact fields") { t.Errorf("default projection should announce itself on stderr, got:\n%s", stderrText) } @@ -296,7 +296,7 @@ func TestIncidentListStructuredDefaultUsesCompactProjection(t *testing.T) { // Positive keys must come from stdout alone: the stderr note embeds the // same field names, so a merged capture would satisfy this vacuously. - for _, key := range []string{"incident_id", "title", "incident_severity", "progress", "start_time", "channel_id"} { + for _, key := range []string{"incident_id", "num", "title", "incident_severity", "progress", "start_time", "channel_id", "detail_url"} { if !strings.Contains(out, key) { t.Errorf("default toon output missing compact key %q, got:\n%s", key, out) } @@ -572,7 +572,7 @@ func TestIncidentSimilarStructuredProjection(t *testing.T) { if err := json.Unmarshal([]byte(strings.TrimSpace(out)), &rows); err != nil { t.Fatalf("parse compact similar json: %v\n%s", err, out) } - want := []string{"incident_id", "title", "incident_severity", "progress", "start_time", "close_time", "ack_time", "alert_cnt", "root_cause", "score"} + want := []string{"incident_id", "num", "title", "incident_severity", "progress", "start_time", "close_time", "ack_time", "alert_cnt", "root_cause", "score", "detail_url"} if len(rows) != len(items) { t.Fatalf("got %d rows, want %d", len(rows), len(items)) } diff --git a/internal/cli/incident.go b/internal/cli/incident.go index f4833d5..589ee0e 100644 --- a/internal/cli/incident.go +++ b/internal/cli/incident.go @@ -75,12 +75,12 @@ func newIncidentListCmd() *cobra.Command { var progress, severity, query, since, until, nums, fields, channel string var channelID int64 var limit, page int - defaultStructuredFields := []string{"incident_id", "title", "incident_severity", "progress", "start_time", "channel_id"} + defaultStructuredFields := []string{"incident_id", "num", "title", "incident_severity", "progress", "start_time", "channel_id", "detail_url"} cmd := &cobra.Command{ Use: "list", Short: "List incidents", - Long: curatedLong("List incidents matching the given filters. The --since/--until window must be < 31 days; --limit max is 100. In json/toon mode, rows default to the compact fields incident_id,title,incident_severity,progress,start_time,channel_id; pass --fields to choose a different projection.\n\nSee also: fduty insight for aggregated metrics (MTTA, MTTR, noise reduction), fduty insight incident-list for metric-rich filtered incident rows, and fduty insight incident-export for CSV incident exports.", "Incidents", "List"), + Long: curatedLong("List incidents matching the given filters. The --since/--until window must be < 31 days; --limit max is 100. In json/toon mode, rows default to the compact fields incident_id,num,title,incident_severity,progress,start_time,channel_id,detail_url; pass --fields to choose a different projection.\n\nSee also: fduty insight for aggregated metrics (MTTA, MTTR, noise reduction), fduty insight incident-list for metric-rich filtered incident rows, and fduty insight incident-export for CSV incident exports.", "Incidents", "List"), RunE: func(cmd *cobra.Command, args []string) error { return runCommand(cmd, args, func(ctx *RunContext) error { startTime, err := timeutil.Parse(since) @@ -629,7 +629,7 @@ func newIncidentSimilarCmd() *cobra.Command { } if ctx.Structured() { - fieldNames := []string{"incident_id", "title", "incident_severity", "progress", "start_time", "close_time", "ack_time", "alert_cnt", "root_cause", "score"} + fieldNames := []string{"incident_id", "num", "title", "incident_severity", "progress", "start_time", "close_time", "ack_time", "alert_cnt", "root_cause", "score", "detail_url"} if fields != "" { fieldNames = parseStringSlice(fields) } else { diff --git a/internal/cli/incident_summary_script_test.go b/internal/cli/incident_summary_script_test.go index 2eeab13..10d33e8 100644 --- a/internal/cli/incident_summary_script_test.go +++ b/internal/cli/incident_summary_script_test.go @@ -39,7 +39,7 @@ func TestIncidentSummaryScriptCompactOutput(t *testing.T) { if len(lines) != 6 { t.Fatalf("fduty calls = %d, want 6:\n%s", len(lines), invocations) } - wantDetail := "incident detail inc-1 --fields incident_id,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time,channel_id --output-format toon" + wantDetail := "incident detail inc-1 --fields incident_id,num,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time,channel_id,detail_url --output-format toon" if lines[0] != wantDetail { t.Fatalf("detail call = %q, want compact projection %q", lines[0], wantDetail) } diff --git a/internal/cli/zz_generated_incidents.go b/internal/cli/zz_generated_incidents.go index e1d686a..b27b37c 100644 --- a/internal/cli/zz_generated_incidents.go +++ b/internal/cli/zz_generated_incidents.go @@ -441,6 +441,7 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[]; - data_source_type (string) — Deprecated. Use 'integration_type'. - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - description (string) (required) — Alert description. + - detail_url (string) — Console URL of this alert ('{console}/alert/detail/{alert_id}'). Empty when the deployment has no console base configured. - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - event_cnt (integer) (required) — Total number of raw events merged into this alert. - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert. @@ -1419,6 +1420,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le - data_source_type (string) — Deprecated. Use 'integration_type'. - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - description (string) (required) — Alert description. + - detail_url (string) — Console URL of this alert ('{console}/alert/detail/{alert_id}'). Empty when the deployment has no console base configured. - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - event_cnt (integer) (required) — Total number of raw events merged into this alert. - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert. @@ -1678,6 +1680,7 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[]; - data_source_type (string) — Deprecated. Use 'integration_type'. - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - description (string) (required) — Alert description. + - detail_url (string) — Console URL of this alert ('{console}/alert/detail/{alert_id}'). Empty when the deployment has no console base configured. - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - event_cnt (integer) (required) — Total number of raw events merged into this alert. - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert. @@ -1978,6 +1981,7 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[]; - data_source_type (string) — Deprecated. Use 'integration_type'. - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - description (string) (required) — Alert description. + - detail_url (string) — Console URL of this alert ('{console}/alert/detail/{alert_id}'). Empty when the deployment has no console base configured. - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - event_cnt (integer) (required) — Total number of raw events merged into this alert. - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert. @@ -2271,6 +2275,7 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[]; - data_source_type (string) — Deprecated. Use 'integration_type'. - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - description (string) (required) — Alert description. + - detail_url (string) — Console URL of this alert ('{console}/alert/detail/{alert_id}'). Empty when the deployment has no console base configured. - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null. - event_cnt (integer) (required) — Total number of raw events merged into this alert. - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert. diff --git a/internal/cli/zz_generated_response_help.go b/internal/cli/zz_generated_response_help.go index 4cdd5f2..28c3d28 100644 --- a/internal/cli/zz_generated_response_help.go +++ b/internal/cli/zz_generated_response_help.go @@ -109,16 +109,16 @@ var responseHelpBySDKMethod = map[string]string{ "Facets.FacetCount": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - count (integer) (required) — Number of events with this facet value in the time range.\n - facet_value (any) (required) — The facet value. Type matches the field's `value_type`.\n", "Facets.FieldList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID. 0 for built-in fields.\n - description (string) (required) — Description of what this field captures.\n - edit_able (boolean) (required) — True if this is a custom field that can be edited by the user.\n - enum_values (array) (required) — Predefined enumerable values for this field. Element type matches the field's `value_type`: string for `string`, number for `number`, boolean for `boolean`. Empty when the field has no fixed set of values.\n - field_key (string) (required) — Unique field key, e.g. `error.type`.\n - field_name (string) (required) — Human-readable field name.\n - group (string) (required) — Display group for this field.\n - is_facet (boolean) (required) — True if value distribution counting is supported for this field.\n - queryable (boolean) (required) — True if this field can be used in DQL/SQL queries.\n - scopes (array) (required) — RUM scopes this field appears in.\n - show_type (string) (required) — Display type in the analytics UI. One of `list` (shown as an enumerated value list; only this type supports facet counting) or `range` (filtered and shown as a numeric/time range). [list, range]\n - status (string) (required) — Field status, e.g. `active`.\n - unit_family (string) (required) — Measurement unit family, e.g. `time`, `bytes`. Empty for dimensionless fields.\n - unit_name (string) (required) — Specific measurement unit, e.g. `millisecond`, `byte`.\n - value_type (string) (required) — Data type of the field value. One of: | Value | Meaning | |---|---| | `string` | String | | `number` | Numeric | | `boolean` | Boolean | | `array` | Array of strings | | `array` | Array of numbers | | `array` | Array of booleans | [string, number, boolean, array, array, array]\n", "ImIntegrations.List": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account this integration belongs to.\n - category (string) (required) — Plugin category; `im` for the IM integrations returned here.\n - created_at (string) (required) — Unix timestamp in seconds when the integration was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator_id (integer) (required) — Person who created the integration.\n - data_source_id (integer) (required) — Integration ID.\n - description (string) (required) — Integration description.\n - exclusive_data_source_id (integer) (required) — Legacy exclusive-integration linkage; deprecated.\n - integration_id (integer) (required) — Integration ID, alias of data_source_id.\n - integration_key (string) (required) — Push key used by alert sources to send to this integration.\n - last_time (string) (required) — Unix timestamp in seconds of the most recent activity in this datasource. Always `0` — this endpoint does not populate the field. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - name (string) (required) — Integration name.\n - no_editable (boolean) (required) — Whether the integration is read-only.\n - plugin_id (integer) (required) — Plugin ID backing this integration.\n - plugin_type (string) (required) — Plugin type identifier of the IM integration, for example `feishu_app`, `dingtalk_app`, `wecom_app`, `slack_app`, or `teams_app`.\n - plugin_type_name (string) (required) — Localized display name of the integration plugin type.\n - ref_id (string) (required) — External reference ID of the integration.\n - settings (object) (required) — Plugin-specific configuration of the integration.\n - status (string) (required) — Integration status: `enabled` or `disabled`. Deleted integrations are never returned. [enabled, disabled]\n - team_id (integer) (required) — Team that owns this integration.\n - updated_at (string) (required) — Unix timestamp in seconds when the integration was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - updated_by (integer) (required) — Person who last updated the integration.\n", - "Incidents.AlertList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID.\n - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n - channel_id (integer) (required) — Channel ID.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n - data_source_type (string) — Deprecated. Use `integration_type`.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Alert description.\n - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - incident (object) — Parent incident reference, if the alert has been merged into one.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) (required) — Integration ID that produced the alert.\n - integration_name (string) (required) — Integration display name.\n - integration_ref_id (string) (required) — Integration reference ID.\n - integration_type (string) (required) — Integration type string.\n - labels (object) (required) — Alert labels.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) (required) — Primary responder email, if any.\n - responder_name (string) (required) — Primary responder name, if any.\n - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) (required) — Alert title.\n - title_rule (string) (required) — Title rendering rule.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", + "Incidents.AlertList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID.\n - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n - channel_id (integer) (required) — Channel ID.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n - data_source_type (string) — Deprecated. Use `integration_type`.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Alert description.\n - detail_url (string) — Console URL of this alert (`{console}/alert/detail/{alert_id}`). Empty when the deployment has no console base configured.\n - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - incident (object) — Parent incident reference, if the alert has been merged into one.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) (required) — Integration ID that produced the alert.\n - integration_name (string) (required) — Integration display name.\n - integration_ref_id (string) (required) — Integration reference ID.\n - integration_type (string) (required) — Integration type string.\n - labels (object) (required) — Alert labels.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) (required) — Primary responder email, if any.\n - responder_name (string) (required) — Primary responder name, if any.\n - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) (required) — Alert title.\n - title_rule (string) (required) — Title rendering rule.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", "Incidents.CommentTypeCreate": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - comment_type_id (string) (required) — ID of the created comment type (24-character hex ObjectID).\n - item (object) (required) — An account-level comment type that can be attached to incident comments.\n - account_id (integer) (required) — Account ID that owns the comment type.\n - color (string) (required) — Label color as a hex value in #RRGGBB format (stored uppercase).\n - comment_type_id (string) (required) — Comment type ID (24-character hex ObjectID).\n - created_at (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator_id (integer) (required) — ID of the user who created the comment type.\n - name (string) (required) — Display name of the comment type. Unique within the account (case-insensitive, trimmed). (≤40 chars)\n - position (integer) (required) — 1-based display position of the comment type.\n - updated_at (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - updated_by (integer) (required) — ID of the user who last updated the comment type.\n", "Incidents.CommentTypeList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID that owns the comment type.\n - color (string) (required) — Label color as a hex value in #RRGGBB format (stored uppercase).\n - comment_type_id (string) (required) — Comment type ID (24-character hex ObjectID).\n - created_at (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator_id (integer) (required) — ID of the user who created the comment type.\n - name (string) (required) — Display name of the comment type. Unique within the account (case-insensitive, trimmed). (≤40 chars)\n - position (integer) (required) — 1-based display position of the comment type.\n - updated_at (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - updated_by (integer) (required) — ID of the user who last updated the comment type.\n", "Incidents.Create": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - incident_id (string) (required) — Newly created incident ID (MongoDB ObjectID).\n - title (string) (required) — Echoes the incident title from the request.\n", "Incidents.CustomActionDo": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - message (string) — Error message if the action's HTTP call failed; omitted on success.\n", "Incidents.Feed": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID.\n - created_at (string) (required) — Creation timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator_id (integer) (required) — User ID of the actor. `0` means system-generated.\n - deleted_at (string) — Soft-delete timestamp (ms). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - detail (object) (required) — Type-specific payload. The concrete shape is determined by `type`; `null` when the entry has no structured detail.\n - added_assignee_ids (array) — Member IDs added as assignees.\n - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n - assignee_ids (array) — Assignee member IDs.\n - by (string) — Delivery channel or method label.\n - chat_id (string) — Chat group identifier.\n - chat_name (string) — Chat group display name.\n - chats (array) — Per-chat delivery records.\n - chat_id (string) — Chat group identifier.\n - chat_name (string) — Chat group display name.\n - data_source_id (integer) — Integration data source ID used to send the notification.\n - failed_reason (string) — Failure reason if delivery did not succeed.\n - comment (string) — Form summary recorded as a timeline comment. Omitted when no acknowledgement form summary was submitted.\n - comment_type (object) — Resolved display of an account-level comment type, populated at read time from the current type definition.\n - color (string) (required) — Badge color in #RRGGBB format.\n - id (string) (required) — Comment type ID (MongoDB ObjectID).\n - name (string) (required) — Display name of the comment type. (≤40 chars)\n - comment_type_id (string) — ObjectID of the account-level comment type attached to the comment.\n - emails (array) — Email recipients, used by integrations such as ServiceNow.\n - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n - field_name (string) — Name of the custom field that was updated.\n - fire_type (string) — Whether this is the first fire or a refire. `fire`: the first notification for this escalation layer; `refire`: a repeat notification to the same layer when the incident remains unhandled, sent at the layer's notify interval and capped by the layer's maximum refire count. [fire, refire]\n - from (string) — Source that triggered the resolve. | Value | Meaning | |---|---| | `voice` | Phone-call (voice DTMF) action. | | `console` | Console (Web UI) action. | | `card` | IM notification card button (DingTalk/Feishu/Slack/Teams). | | `wcard` | WeCom notification card button. | | `event` | Event-driven: auto-close when all related alerts recover to Ok, or a close synced from an external ITSM system. | | `autorslv` | Auto-resolve: closed by the system after no new alerts within the channel's auto-resolve timeout. | | `autorefresh` | Card auto-refresh (reserved; never appears on resolve feeds). | | `escalation` | Escalation flow (reserved; never appears on resolve feeds). | [voice, console, card, wcard, event, autorslv, autorefresh, escalation]\n - from_description (string) — Description before the update.\n - from_priority (string) — Priority label before the update.\n - from_status (string) — Status label before the update.\n - from_title (string) — Title before the update.\n - from_type (string) — Work item type before the conversion. `action`: an action item anchored to the incident itself; `follow_up`: an improvement item anchored to a post-mortem. Conversion currently only supports `action` → `follow_up`, so `from_type` is always `action` in this event. [action, follow_up]\n - id (string) — Opaque assignment ID generated by the server.\n - images (array) — Images from the acknowledgement form, recorded on the timeline entry only. Omitted when none were submitted.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - in_mins (integer) — Window length in minutes.\n - integration_id (integer) — Integration ID that executed the action.\n - integration_name (string) — Integration display name.\n - item_type (string) — Work item type. `action`: an action item anchored to the incident itself, convertible to `follow_up` later; `follow_up`: an improvement item anchored to a post-mortem, requiring the incident to be linked to that post-mortem at creation. [action, follow_up]\n - layer_idx (integer) — Current level index within the escalation rule.\n - max_changes (integer) — Maximum state changes allowed within the window.\n - minutes (integer) — Snooze duration in minutes.\n - msg_id (string) — Upstream message ID returned by the delivery channel.\n - mute_mins (integer) — Mute duration in minutes once flapping is detected.\n - mute_reply (boolean) — Whether replies to this comment are muted.\n - notify (object) — Override the notification channels used for this assignment.\n - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n - personal_channels (array) — Channels to use (e.g. `voice`, `sms`, `email`).\n - template_id (string) — Notification template ID (MongoDB ObjectID).\n - owner_id (integer) — Member ID that performed the merge.\n - person_ids (array) — Member IDs to assign directly.\n - persons (array) — Per-person delivery records.\n - failed_reason (string) — Failure reason if delivery did not succeed.\n - person_id (integer) — Recipient member ID.\n - sms_content (string) — SMS text delivered to the recipient; present on SMS deliveries.\n - plugin_type (string) — Chat integration plugin type.\n - post_mortem_id (string) — ID of the post-mortem the work item is bound to.\n - progress (string) — Progress note entered at acknowledgement.\n - reason (string) — Reason why the incident was reopened.\n - remove_source_incidents (boolean) — True if the source incidents were removed after merging.\n - removed_assignee_ids (array) — Member IDs removed from assignees.\n - reporter_email (string) — Email of the reporter when the incident was created externally.\n - rid (string) — Notification record ID.\n - robots (array) — Per-robot delivery records.\n - alias (string) — Robot alias.\n - failed_reason (string) — Failure reason if delivery did not succeed.\n - token (string) — Robot token or identifier.\n - severity (string) — Severity level. [Ok, Critical, Warning, Info]\n - share_link (string) — Shareable join link for the war room.\n - snoozedBefore (integer) — Unix timestamp at which the prior snooze was scheduled to end.\n - source_alerts (array) — Source alerts merged into the target incident. Omitted when empty.\n - alert_id (string) — Alert ID (ObjectID hex string).\n - title (string) — Alert title, resolved at read time. Omitted when empty.\n - source_incidents (array) — Source incidents that were merged.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - source_responders (array) — Responder member IDs carried over from the source incidents.\n - status (string) — Work item status label (e.g. `open`, `done`).\n - target_incident (object) — Brief incident reference embedded in an alert.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - threshold (integer) — Storm threshold that was reached.\n - title (string) — Initial incident title.\n - to (array) — Member IDs that received the assignment.\n - to_description (string) — Description after the update.\n - to_priority (string) — Priority label after the update.\n - to_status (string) — Status label after the update.\n - to_type (string) — Work item type after the conversion. `action`: an action item anchored to the incident itself; `follow_up`: an improvement item anchored to a post-mortem. Conversion currently only supports `action` → `follow_up`, so `to_type` is always `follow_up` in this event, and a successful conversion immediately tries to bind the incident's post-mortem. [action, follow_up]\n - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n - work_item_id (string) — Work item ID.\n - ref_id (string) (required) — ObjectID of the source alert or incident this entry references.\n - type (string) (required) — Incident timeline entry type. Each value identifies one lifecycle event; the matching `detail` payload shape is determined by this field. Incident types are prefixed with `i_`. | Type | Meaning | |---|---| | `i_new` | Incident Created: A new incident was created automatically or manually. | | `i_assign` | Assigned: Incident was assigned to responders. | | `i_a_rspd` | Responder Added: Additional responders joined the incident. | | `i_notify` | Notification dispatched through a channel at a specific escalation level. | | `i_storm` | Alert storm threshold reached on the incident. | | `i_snooze` | Notifications snoozed for a given duration. | | `i_wake` | Snooze cancelled and notifications resumed. | | `i_ack` | Acknowledged: Responder confirmed they are working on the incident. | | `i_unack` | Acknowledgement removed. | | `i_comm` | Comment: Responder logged progress or key information. | | `i_rslv` | Resolved: Incident was marked as resolved. | | `i_reopen` | Reopened: Resolved incident was reopened, possibly due to recurrence. | | `i_merge` | Merged: Multiple related incidents were merged into one. | | `i_r_title` | Title updated. | | `i_r_desc` | Description updated. | | `i_r_impact` | Impact updated. | | `i_r_rc` | Root cause updated. | | `i_r_rsltn` | Resolution updated. | | `i_r_severity` | Severity Changed: Incident severity level was adjusted. | | `i_r_field` | Custom field value updated. | | `i_m_flapping` | Incident muted by flapping detection. | | `i_m_reply` | Mute reply marker on a comment. | | `i_custom` | Action: Automated action or script was triggered. | | `i_wr_create` | War Room Created: Chat group was created for collaborative response. | | `i_wr_delete` | War room chat group deleted. | | `i_auto_refresh` | Card auto-refresh event posted back to the timeline. | | `i_wi_created` | Work Item Created: An Action or Follow-up was created. | | `i_wi_updated` | Work Item Updated: Title, description, status, or priority was changed. | | `i_wi_assignees` | Work Item Assignees Changed: Assignees were updated. | | `i_wi_completed` | Work Item Completed: An assignee marked the work item complete. | | `i_wi_converted` | Work Item Converted: An Action was converted to a Follow-up. | | `i_wi_bound` | Work Item Bound: A converted Follow-up was bound to a post-mortem. | | `i_wi_deleted` | Work Item Deleted: An Action or Follow-up was soft-deleted. | | `a_merge` | Alert Merged: An alert was merged into an existing incident. | [i_new, i_assign, i_a_rspd, i_notify, i_storm, i_snooze, i_wake, i_ack, i_unack, i_comm, i_rslv, i_reopen, i_merge, i_r_title, i_r_desc, i_r_impact, i_r_rc, i_r_rsltn, i_r_severity, i_r_field, i_m_flapping, i_m_reply, i_custom, i_wr_create, i_wr_delete, i_auto_refresh, i_wi_created, i_wi_updated, i_wi_assignees, i_wi_completed, i_wi_converted, i_wi_bound, i_wi_deleted, a_merge]\n - updated_at (string) (required) — Last update timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", - "Incidents.Info": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - account_id (integer) (required) — Account ID that owns the incident.\n - account_locale (string) (required) — Account locale.\n - account_name (string) (required) — Account name.\n - account_time_zone (string) (required) — Account time zone.\n - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n - ai_summary (string) (required) — AI-generated summary of the incident.\n - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n - alerts (array) — Embedded alerts, only populated for notification templates and custom actions.\n - account_id (integer) (required) — Account ID.\n - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n - channel_id (integer) (required) — Channel ID.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n - data_source_type (string) — Deprecated. Use `integration_type`.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Alert description.\n - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - incident (object) — Parent incident reference, if the alert has been merged into one.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) (required) — Integration ID that produced the alert.\n - integration_name (string) (required) — Integration display name.\n - integration_ref_id (string) (required) — Integration reference ID.\n - integration_type (string) (required) — Integration type string.\n - labels (object) (required) — Alert labels.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) (required) — Primary responder email, if any.\n - responder_name (string) (required) — Primary responder name, if any.\n - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) (required) — Alert title.\n - title_rule (string) (required) — Title rendering rule.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - assigned_to (object) (required) — Current assignment target for the incident.\n - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n - emails (array) — Email recipients, used by integrations such as ServiceNow.\n - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n - id (string) — Opaque assignment ID generated by the server.\n - layer_idx (integer) — Current level index within the escalation rule.\n - notify (object) — Override the notification channels used for this assignment.\n - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n - personal_channels (array) — Channels to use (e.g. `voice`, `sms`, `email`).\n - template_id (string) — Notification template ID (MongoDB ObjectID).\n - person_ids (array) — Member IDs to assign directly.\n - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - closer (object) — Closer member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator (object) — Creator member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - data_source_ids (array) — Deprecated. Use `integration_ids` instead.\n - data_source_type (string) — Deprecated. Use `integration_type` instead.\n - data_source_types (array) — Deprecated. Use `integration_types` instead.\n - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Incident description.\n - detail_url (string) (required) — Web console URL for the incident.\n - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n - fields (object) (required) — Custom field values keyed by field name.\n - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - impact (string) (required) — Impact description.\n - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n - integration_id (integer) (required) — First integration associated with the incident.\n - integration_ids (array) (required) — All integration IDs contributing alerts to this incident.\n - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n - integration_types (array) (required) — Integration type strings for all contributing integrations.\n - labels (object) (required) — Labels propagated from alerts.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - links (array) — Channel-level link integrations rendered for this incident.\n - endpoint (string) (required) — Rendered URL for the link.\n - name (string) (required) — Display name of the link.\n - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n - manual_overrides (array) (required) — Fields that were manually overridden after auto-population.\n - num (string) (required) — Short display identifier; not guaranteed unique.\n - owner (object) — Owner member info. May be deprecated.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n - reporter_email (string) — Reporter email for manually created incidents.\n - resolution (string) (required) — Resolution notes.\n - responders (array) (required) — Current responders with assignment/acknowledgement state.\n - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - as (string) — Role label of this responder.\n - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - email (string) — Member email, filled by the server.\n - person_id (integer) (required) — Responder member ID.\n - person_name (string) — Member display name, filled by the server.\n - root_cause (string) (required) — Root cause analysis.\n - silence_url (string) (required) — Quick-silence URL for this incident.\n - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n - title (string) (required) — Incident title.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", - "Incidents.List": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID that owns the incident.\n - account_locale (string) (required) — Account locale.\n - account_name (string) (required) — Account name.\n - account_time_zone (string) (required) — Account time zone.\n - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n - ai_summary (string) (required) — AI-generated summary of the incident.\n - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n - alerts (array) — Embedded alerts, only populated for notification templates and custom actions.\n - account_id (integer) (required) — Account ID.\n - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n - channel_id (integer) (required) — Channel ID.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n - data_source_type (string) — Deprecated. Use `integration_type`.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Alert description.\n - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - incident (object) — Parent incident reference, if the alert has been merged into one.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) (required) — Integration ID that produced the alert.\n - integration_name (string) (required) — Integration display name.\n - integration_ref_id (string) (required) — Integration reference ID.\n - integration_type (string) (required) — Integration type string.\n - labels (object) (required) — Alert labels.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) (required) — Primary responder email, if any.\n - responder_name (string) (required) — Primary responder name, if any.\n - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) (required) — Alert title.\n - title_rule (string) (required) — Title rendering rule.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - assigned_to (object) (required) — Current assignment target for the incident.\n - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n - emails (array) — Email recipients, used by integrations such as ServiceNow.\n - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n - id (string) — Opaque assignment ID generated by the server.\n - layer_idx (integer) — Current level index within the escalation rule.\n - notify (object) — Override the notification channels used for this assignment.\n - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n - personal_channels (array) — Channels to use (e.g. `voice`, `sms`, `email`).\n - template_id (string) — Notification template ID (MongoDB ObjectID).\n - person_ids (array) — Member IDs to assign directly.\n - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - closer (object) — Closer member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator (object) — Creator member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - data_source_ids (array) — Deprecated. Use `integration_ids` instead.\n - data_source_type (string) — Deprecated. Use `integration_type` instead.\n - data_source_types (array) — Deprecated. Use `integration_types` instead.\n - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Incident description.\n - detail_url (string) (required) — Web console URL for the incident.\n - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n - fields (object) (required) — Custom field values keyed by field name.\n - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - impact (string) (required) — Impact description.\n - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n - integration_id (integer) (required) — First integration associated with the incident.\n - integration_ids (array) (required) — All integration IDs contributing alerts to this incident.\n - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n - integration_types (array) (required) — Integration type strings for all contributing integrations.\n - labels (object) (required) — Labels propagated from alerts.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - links (array) — Channel-level link integrations rendered for this incident.\n - endpoint (string) (required) — Rendered URL for the link.\n - name (string) (required) — Display name of the link.\n - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n - manual_overrides (array) (required) — Fields that were manually overridden after auto-population.\n - num (string) (required) — Short display identifier; not guaranteed unique.\n - owner (object) — Owner member info. May be deprecated.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n - reporter_email (string) — Reporter email for manually created incidents.\n - resolution (string) (required) — Resolution notes.\n - responders (array) (required) — Current responders with assignment/acknowledgement state.\n - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - as (string) — Role label of this responder.\n - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - email (string) — Member email, filled by the server.\n - person_id (integer) (required) — Responder member ID.\n - person_name (string) — Member display name, filled by the server.\n - root_cause (string) (required) — Root cause analysis.\n - silence_url (string) (required) — Quick-silence URL for this incident.\n - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n - title (string) (required) — Incident title.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", - "Incidents.ListByIDs": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID that owns the incident.\n - account_locale (string) (required) — Account locale.\n - account_name (string) (required) — Account name.\n - account_time_zone (string) (required) — Account time zone.\n - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n - ai_summary (string) (required) — AI-generated summary of the incident.\n - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n - alerts (array) — Embedded alerts, only populated for notification templates and custom actions.\n - account_id (integer) (required) — Account ID.\n - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n - channel_id (integer) (required) — Channel ID.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n - data_source_type (string) — Deprecated. Use `integration_type`.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Alert description.\n - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - incident (object) — Parent incident reference, if the alert has been merged into one.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) (required) — Integration ID that produced the alert.\n - integration_name (string) (required) — Integration display name.\n - integration_ref_id (string) (required) — Integration reference ID.\n - integration_type (string) (required) — Integration type string.\n - labels (object) (required) — Alert labels.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) (required) — Primary responder email, if any.\n - responder_name (string) (required) — Primary responder name, if any.\n - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) (required) — Alert title.\n - title_rule (string) (required) — Title rendering rule.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - assigned_to (object) (required) — Current assignment target for the incident.\n - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n - emails (array) — Email recipients, used by integrations such as ServiceNow.\n - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n - id (string) — Opaque assignment ID generated by the server.\n - layer_idx (integer) — Current level index within the escalation rule.\n - notify (object) — Override the notification channels used for this assignment.\n - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n - personal_channels (array) — Channels to use (e.g. `voice`, `sms`, `email`).\n - template_id (string) — Notification template ID (MongoDB ObjectID).\n - person_ids (array) — Member IDs to assign directly.\n - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - closer (object) — Closer member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator (object) — Creator member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - data_source_ids (array) — Deprecated. Use `integration_ids` instead.\n - data_source_type (string) — Deprecated. Use `integration_type` instead.\n - data_source_types (array) — Deprecated. Use `integration_types` instead.\n - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Incident description.\n - detail_url (string) (required) — Web console URL for the incident.\n - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n - fields (object) (required) — Custom field values keyed by field name.\n - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - impact (string) (required) — Impact description.\n - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n - integration_id (integer) (required) — First integration associated with the incident.\n - integration_ids (array) (required) — All integration IDs contributing alerts to this incident.\n - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n - integration_types (array) (required) — Integration type strings for all contributing integrations.\n - labels (object) (required) — Labels propagated from alerts.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - links (array) — Channel-level link integrations rendered for this incident.\n - endpoint (string) (required) — Rendered URL for the link.\n - name (string) (required) — Display name of the link.\n - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n - manual_overrides (array) (required) — Fields that were manually overridden after auto-population.\n - num (string) (required) — Short display identifier; not guaranteed unique.\n - owner (object) — Owner member info. May be deprecated.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n - reporter_email (string) — Reporter email for manually created incidents.\n - resolution (string) (required) — Resolution notes.\n - responders (array) (required) — Current responders with assignment/acknowledgement state.\n - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - as (string) — Role label of this responder.\n - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - email (string) — Member email, filled by the server.\n - person_id (integer) (required) — Responder member ID.\n - person_name (string) — Member display name, filled by the server.\n - root_cause (string) (required) — Root cause analysis.\n - silence_url (string) (required) — Quick-silence URL for this incident.\n - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n - title (string) (required) — Incident title.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", - "Incidents.PastList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID that owns the incident.\n - account_locale (string) (required) — Account locale.\n - account_name (string) (required) — Account name.\n - account_time_zone (string) (required) — Account time zone.\n - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n - ai_summary (string) (required) — AI-generated summary of the incident.\n - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n - alerts (array) — Embedded alerts, only populated for notification templates and custom actions.\n - account_id (integer) (required) — Account ID.\n - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n - channel_id (integer) (required) — Channel ID.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n - data_source_type (string) — Deprecated. Use `integration_type`.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Alert description.\n - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - incident (object) — Parent incident reference, if the alert has been merged into one.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) (required) — Integration ID that produced the alert.\n - integration_name (string) (required) — Integration display name.\n - integration_ref_id (string) (required) — Integration reference ID.\n - integration_type (string) (required) — Integration type string.\n - labels (object) (required) — Alert labels.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) (required) — Primary responder email, if any.\n - responder_name (string) (required) — Primary responder name, if any.\n - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) (required) — Alert title.\n - title_rule (string) (required) — Title rendering rule.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - assigned_to (object) (required) — Current assignment target for the incident.\n - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n - emails (array) — Email recipients, used by integrations such as ServiceNow.\n - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n - id (string) — Opaque assignment ID generated by the server.\n - layer_idx (integer) — Current level index within the escalation rule.\n - notify (object) — Override the notification channels used for this assignment.\n - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n - personal_channels (array) — Channels to use (e.g. `voice`, `sms`, `email`).\n - template_id (string) — Notification template ID (MongoDB ObjectID).\n - person_ids (array) — Member IDs to assign directly.\n - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - closer (object) — Closer member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator (object) — Creator member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - data_source_ids (array) — Deprecated. Use `integration_ids` instead.\n - data_source_type (string) — Deprecated. Use `integration_type` instead.\n - data_source_types (array) — Deprecated. Use `integration_types` instead.\n - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Incident description.\n - detail_url (string) (required) — Web console URL for the incident.\n - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n - fields (object) (required) — Custom field values keyed by field name.\n - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - impact (string) (required) — Impact description.\n - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n - integration_id (integer) (required) — First integration associated with the incident.\n - integration_ids (array) (required) — All integration IDs contributing alerts to this incident.\n - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n - integration_types (array) (required) — Integration type strings for all contributing integrations.\n - labels (object) (required) — Labels propagated from alerts.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - links (array) — Channel-level link integrations rendered for this incident.\n - endpoint (string) (required) — Rendered URL for the link.\n - name (string) (required) — Display name of the link.\n - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n - manual_overrides (array) (required) — Fields that were manually overridden after auto-population.\n - num (string) (required) — Short display identifier; not guaranteed unique.\n - owner (object) — Owner member info. May be deprecated.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n - reporter_email (string) — Reporter email for manually created incidents.\n - resolution (string) (required) — Resolution notes.\n - responders (array) (required) — Current responders with assignment/acknowledgement state.\n - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - as (string) — Role label of this responder.\n - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - email (string) — Member email, filled by the server.\n - person_id (integer) (required) — Responder member ID.\n - person_name (string) — Member display name, filled by the server.\n - root_cause (string) (required) — Root cause analysis.\n - score (number) (required) — Similarity score from the vector search.\n - silence_url (string) (required) — Quick-silence URL for this incident.\n - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n - title (string) (required) — Incident title.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", + "Incidents.Info": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - account_id (integer) (required) — Account ID that owns the incident.\n - account_locale (string) (required) — Account locale.\n - account_name (string) (required) — Account name.\n - account_time_zone (string) (required) — Account time zone.\n - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n - ai_summary (string) (required) — AI-generated summary of the incident.\n - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n - alerts (array) — Embedded alerts, only populated for notification templates and custom actions.\n - account_id (integer) (required) — Account ID.\n - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n - channel_id (integer) (required) — Channel ID.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n - data_source_type (string) — Deprecated. Use `integration_type`.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Alert description.\n - detail_url (string) — Console URL of this alert (`{console}/alert/detail/{alert_id}`). Empty when the deployment has no console base configured.\n - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - incident (object) — Parent incident reference, if the alert has been merged into one.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) (required) — Integration ID that produced the alert.\n - integration_name (string) (required) — Integration display name.\n - integration_ref_id (string) (required) — Integration reference ID.\n - integration_type (string) (required) — Integration type string.\n - labels (object) (required) — Alert labels.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) (required) — Primary responder email, if any.\n - responder_name (string) (required) — Primary responder name, if any.\n - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) (required) — Alert title.\n - title_rule (string) (required) — Title rendering rule.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - assigned_to (object) (required) — Current assignment target for the incident.\n - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n - emails (array) — Email recipients, used by integrations such as ServiceNow.\n - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n - id (string) — Opaque assignment ID generated by the server.\n - layer_idx (integer) — Current level index within the escalation rule.\n - notify (object) — Override the notification channels used for this assignment.\n - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n - personal_channels (array) — Channels to use (e.g. `voice`, `sms`, `email`).\n - template_id (string) — Notification template ID (MongoDB ObjectID).\n - person_ids (array) — Member IDs to assign directly.\n - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - closer (object) — Closer member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator (object) — Creator member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - data_source_ids (array) — Deprecated. Use `integration_ids` instead.\n - data_source_type (string) — Deprecated. Use `integration_type` instead.\n - data_source_types (array) — Deprecated. Use `integration_types` instead.\n - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Incident description.\n - detail_url (string) (required) — Web console URL for the incident.\n - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n - fields (object) (required) — Custom field values keyed by field name.\n - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - impact (string) (required) — Impact description.\n - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n - integration_id (integer) (required) — First integration associated with the incident.\n - integration_ids (array) (required) — All integration IDs contributing alerts to this incident.\n - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n - integration_types (array) (required) — Integration type strings for all contributing integrations.\n - labels (object) (required) — Labels propagated from alerts.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - links (array) — Channel-level link integrations rendered for this incident.\n - endpoint (string) (required) — Rendered URL for the link.\n - name (string) (required) — Display name of the link.\n - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n - manual_overrides (array) (required) — Fields that were manually overridden after auto-population.\n - num (string) (required) — Short display identifier; not guaranteed unique.\n - owner (object) — Owner member info. May be deprecated.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n - reporter_email (string) — Reporter email for manually created incidents.\n - resolution (string) (required) — Resolution notes.\n - responders (array) (required) — Current responders with assignment/acknowledgement state.\n - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - as (string) — Role label of this responder.\n - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - email (string) — Member email, filled by the server.\n - person_id (integer) (required) — Responder member ID.\n - person_name (string) — Member display name, filled by the server.\n - root_cause (string) (required) — Root cause analysis.\n - silence_url (string) (required) — Quick-silence URL for this incident.\n - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n - title (string) (required) — Incident title.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", + "Incidents.List": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID that owns the incident.\n - account_locale (string) (required) — Account locale.\n - account_name (string) (required) — Account name.\n - account_time_zone (string) (required) — Account time zone.\n - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n - ai_summary (string) (required) — AI-generated summary of the incident.\n - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n - alerts (array) — Embedded alerts, only populated for notification templates and custom actions.\n - account_id (integer) (required) — Account ID.\n - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n - channel_id (integer) (required) — Channel ID.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n - data_source_type (string) — Deprecated. Use `integration_type`.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Alert description.\n - detail_url (string) — Console URL of this alert (`{console}/alert/detail/{alert_id}`). Empty when the deployment has no console base configured.\n - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - incident (object) — Parent incident reference, if the alert has been merged into one.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) (required) — Integration ID that produced the alert.\n - integration_name (string) (required) — Integration display name.\n - integration_ref_id (string) (required) — Integration reference ID.\n - integration_type (string) (required) — Integration type string.\n - labels (object) (required) — Alert labels.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) (required) — Primary responder email, if any.\n - responder_name (string) (required) — Primary responder name, if any.\n - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) (required) — Alert title.\n - title_rule (string) (required) — Title rendering rule.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - assigned_to (object) (required) — Current assignment target for the incident.\n - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n - emails (array) — Email recipients, used by integrations such as ServiceNow.\n - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n - id (string) — Opaque assignment ID generated by the server.\n - layer_idx (integer) — Current level index within the escalation rule.\n - notify (object) — Override the notification channels used for this assignment.\n - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n - personal_channels (array) — Channels to use (e.g. `voice`, `sms`, `email`).\n - template_id (string) — Notification template ID (MongoDB ObjectID).\n - person_ids (array) — Member IDs to assign directly.\n - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - closer (object) — Closer member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator (object) — Creator member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - data_source_ids (array) — Deprecated. Use `integration_ids` instead.\n - data_source_type (string) — Deprecated. Use `integration_type` instead.\n - data_source_types (array) — Deprecated. Use `integration_types` instead.\n - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Incident description.\n - detail_url (string) (required) — Web console URL for the incident.\n - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n - fields (object) (required) — Custom field values keyed by field name.\n - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - impact (string) (required) — Impact description.\n - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n - integration_id (integer) (required) — First integration associated with the incident.\n - integration_ids (array) (required) — All integration IDs contributing alerts to this incident.\n - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n - integration_types (array) (required) — Integration type strings for all contributing integrations.\n - labels (object) (required) — Labels propagated from alerts.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - links (array) — Channel-level link integrations rendered for this incident.\n - endpoint (string) (required) — Rendered URL for the link.\n - name (string) (required) — Display name of the link.\n - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n - manual_overrides (array) (required) — Fields that were manually overridden after auto-population.\n - num (string) (required) — Short display identifier; not guaranteed unique.\n - owner (object) — Owner member info. May be deprecated.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n - reporter_email (string) — Reporter email for manually created incidents.\n - resolution (string) (required) — Resolution notes.\n - responders (array) (required) — Current responders with assignment/acknowledgement state.\n - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - as (string) — Role label of this responder.\n - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - email (string) — Member email, filled by the server.\n - person_id (integer) (required) — Responder member ID.\n - person_name (string) — Member display name, filled by the server.\n - root_cause (string) (required) — Root cause analysis.\n - silence_url (string) (required) — Quick-silence URL for this incident.\n - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n - title (string) (required) — Incident title.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", + "Incidents.ListByIDs": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID that owns the incident.\n - account_locale (string) (required) — Account locale.\n - account_name (string) (required) — Account name.\n - account_time_zone (string) (required) — Account time zone.\n - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n - ai_summary (string) (required) — AI-generated summary of the incident.\n - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n - alerts (array) — Embedded alerts, only populated for notification templates and custom actions.\n - account_id (integer) (required) — Account ID.\n - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n - channel_id (integer) (required) — Channel ID.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n - data_source_type (string) — Deprecated. Use `integration_type`.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Alert description.\n - detail_url (string) — Console URL of this alert (`{console}/alert/detail/{alert_id}`). Empty when the deployment has no console base configured.\n - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - incident (object) — Parent incident reference, if the alert has been merged into one.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) (required) — Integration ID that produced the alert.\n - integration_name (string) (required) — Integration display name.\n - integration_ref_id (string) (required) — Integration reference ID.\n - integration_type (string) (required) — Integration type string.\n - labels (object) (required) — Alert labels.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) (required) — Primary responder email, if any.\n - responder_name (string) (required) — Primary responder name, if any.\n - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) (required) — Alert title.\n - title_rule (string) (required) — Title rendering rule.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - assigned_to (object) (required) — Current assignment target for the incident.\n - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n - emails (array) — Email recipients, used by integrations such as ServiceNow.\n - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n - id (string) — Opaque assignment ID generated by the server.\n - layer_idx (integer) — Current level index within the escalation rule.\n - notify (object) — Override the notification channels used for this assignment.\n - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n - personal_channels (array) — Channels to use (e.g. `voice`, `sms`, `email`).\n - template_id (string) — Notification template ID (MongoDB ObjectID).\n - person_ids (array) — Member IDs to assign directly.\n - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - closer (object) — Closer member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator (object) — Creator member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - data_source_ids (array) — Deprecated. Use `integration_ids` instead.\n - data_source_type (string) — Deprecated. Use `integration_type` instead.\n - data_source_types (array) — Deprecated. Use `integration_types` instead.\n - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Incident description.\n - detail_url (string) (required) — Web console URL for the incident.\n - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n - fields (object) (required) — Custom field values keyed by field name.\n - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - impact (string) (required) — Impact description.\n - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n - integration_id (integer) (required) — First integration associated with the incident.\n - integration_ids (array) (required) — All integration IDs contributing alerts to this incident.\n - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n - integration_types (array) (required) — Integration type strings for all contributing integrations.\n - labels (object) (required) — Labels propagated from alerts.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - links (array) — Channel-level link integrations rendered for this incident.\n - endpoint (string) (required) — Rendered URL for the link.\n - name (string) (required) — Display name of the link.\n - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n - manual_overrides (array) (required) — Fields that were manually overridden after auto-population.\n - num (string) (required) — Short display identifier; not guaranteed unique.\n - owner (object) — Owner member info. May be deprecated.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n - reporter_email (string) — Reporter email for manually created incidents.\n - resolution (string) (required) — Resolution notes.\n - responders (array) (required) — Current responders with assignment/acknowledgement state.\n - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - as (string) — Role label of this responder.\n - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - email (string) — Member email, filled by the server.\n - person_id (integer) (required) — Responder member ID.\n - person_name (string) — Member display name, filled by the server.\n - root_cause (string) (required) — Root cause analysis.\n - silence_url (string) (required) — Quick-silence URL for this incident.\n - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n - title (string) (required) — Incident title.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", + "Incidents.PastList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID that owns the incident.\n - account_locale (string) (required) — Account locale.\n - account_name (string) (required) — Account name.\n - account_time_zone (string) (required) — Account time zone.\n - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n - ai_summary (string) (required) — AI-generated summary of the incident.\n - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n - alerts (array) — Embedded alerts, only populated for notification templates and custom actions.\n - account_id (integer) (required) — Account ID.\n - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n - channel_id (integer) (required) — Channel ID.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n - data_source_type (string) — Deprecated. Use `integration_type`.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Alert description.\n - detail_url (string) — Console URL of this alert (`{console}/alert/detail/{alert_id}`). Empty when the deployment has no console base configured.\n - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n - events (array) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - incident (object) — Parent incident reference, if the alert has been merged into one.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - integration_id (integer) (required) — Integration ID that produced the alert.\n - integration_name (string) (required) — Integration display name.\n - integration_ref_id (string) (required) — Integration reference ID.\n - integration_type (string) (required) — Integration type string.\n - labels (object) (required) — Alert labels.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - responder_email (string) (required) — Primary responder email, if any.\n - responder_name (string) (required) — Primary responder name, if any.\n - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - title (string) (required) — Alert title.\n - title_rule (string) (required) — Title rendering rule.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - assigned_to (object) (required) — Current assignment target for the incident.\n - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n - emails (array) — Email recipients, used by integrations such as ServiceNow.\n - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n - id (string) — Opaque assignment ID generated by the server.\n - layer_idx (integer) — Current level index within the escalation rule.\n - notify (object) — Override the notification channels used for this assignment.\n - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n - personal_channels (array) — Channels to use (e.g. `voice`, `sms`, `email`).\n - template_id (string) — Notification template ID (MongoDB ObjectID).\n - person_ids (array) — Member IDs to assign directly.\n - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n - channel_name (string) (required) — Channel display name.\n - channel_status (string) (required) — Channel status.\n - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - closer (object) — Closer member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator (object) — Creator member info.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - data_source_ids (array) — Deprecated. Use `integration_ids` instead.\n - data_source_type (string) — Deprecated. Use `integration_type` instead.\n - data_source_types (array) — Deprecated. Use `integration_types` instead.\n - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) (required) — Incident description.\n - detail_url (string) (required) — Web console URL for the incident.\n - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n - fields (object) (required) — Custom field values keyed by field name.\n - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n - images (array) (required) — Attached images.\n - alt (string) — Alt text.\n - href (string) — Optional link the image points to.\n - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n - impact (string) (required) — Impact description.\n - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n - integration_id (integer) (required) — First integration associated with the incident.\n - integration_ids (array) (required) — All integration IDs contributing alerts to this incident.\n - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n - integration_types (array) (required) — Integration type strings for all contributing integrations.\n - labels (object) (required) — Labels propagated from alerts.\n - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - links (array) — Channel-level link integrations rendered for this incident.\n - endpoint (string) (required) — Rendered URL for the link.\n - name (string) (required) — Display name of the link.\n - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n - manual_overrides (array) (required) — Fields that were manually overridden after auto-population.\n - num (string) (required) — Short display identifier; not guaranteed unique.\n - owner (object) — Owner member info. May be deprecated.\n - as (string) — Role label for this member in the context of the current object.\n - email (string) — Member email address.\n - person_id (integer) — Member ID.\n - person_name (string) — Member display name.\n - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n - reporter_email (string) — Reporter email for manually created incidents.\n - resolution (string) (required) — Resolution notes.\n - responders (array) (required) — Current responders with assignment/acknowledgement state.\n - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - as (string) — Role label of this responder.\n - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - email (string) — Member email, filled by the server.\n - person_id (integer) (required) — Responder member ID.\n - person_name (string) — Member display name, filled by the server.\n - root_cause (string) (required) — Root cause analysis.\n - score (number) (required) — Similarity score from the vector search.\n - silence_url (string) (required) — Quick-silence URL for this incident.\n - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n - title (string) (required) — Incident title.\n - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", "Incidents.PostMortemInfo": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - basics (object) (required) — Basics aggregated automatically from the linked incidents: highest severity, earliest start / latest close time, total duration, and responders.\n - incidents_earliest_start_seconds (integer) (required) — Earliest start time among linked incidents (seconds).\n - incidents_highest_severity (string) (required) — Highest severity among linked incidents.\n - incidents_latest_close_seconds (integer) (required) — Latest close time among linked incidents (seconds).\n - incidents_total_duration_seconds (integer) (required) — Cumulative duration in seconds.\n - responders (array) (required) — Responders involved in the incident(s).\n - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - as (string) — Role label of this responder.\n - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - email (string) — Member email, filled by the server.\n - person_id (integer) (required) — Responder member ID.\n - person_name (string) — Member display name, filled by the server.\n - content (object) (required) — Post-mortem body; the object holds a single `content` field whose value is a BlockNote JSON string.\n - content (string) (required) — Report body content (BlockNote JSON).\n - follow_ups (string) (required) — Follow-up action items rendered as a single string.\n - meta (object) (required) — Post-mortem metadata (lightweight shape used in lists).\n - account_id (integer) (required) — Account ID.\n - author_ids (array) (required) — Member IDs that contributed to the report.\n - channel_id (integer) (required) — Owning channel ID. 0 if none.\n - channel_name (string) (required) — Channel name, filled by the server.\n - created_at_seconds (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - generation (integer) (required) — Collaboration document generation. Incremented by each full content reset; 0 for legacy documents.\n - incident_ids (array) (required) — Linked incident IDs.\n - is_private (boolean) (required) — When true, only team members and admins can view.\n - media_count (integer) (required) — Number of uploaded media files.\n - post_mortem_id (string) (required) — Deterministic post-mortem ID derived from account and incident IDs.\n - revision (integer) (required) — Content revision for optimistic concurrency. Monotonically increases on collaborative saves and full content resets.\n - status (string) (required) — Post-mortem status. `drafting` means still being edited; `published` means published. [drafting, published]\n - team_id (integer) (required) — Owning team ID. 0 if none.\n - template_id (string) (required) — Template used to initialize the report.\n - title (string) (required) — Report title.\n - updated_at_seconds (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", "Incidents.PostMortemList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID.\n - author_ids (array) (required) — Member IDs that contributed to the report.\n - channel_id (integer) (required) — Owning channel ID. 0 if none.\n - channel_name (string) (required) — Channel name, filled by the server.\n - created_at_seconds (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - generation (integer) (required) — Collaboration document generation. Incremented by each full content reset; 0 for legacy documents.\n - incident_ids (array) (required) — Linked incident IDs.\n - is_private (boolean) (required) — When true, only team members and admins can view.\n - media_count (integer) (required) — Number of uploaded media files.\n - post_mortem_id (string) (required) — Deterministic post-mortem ID derived from account and incident IDs.\n - revision (integer) (required) — Content revision for optimistic concurrency. Monotonically increases on collaborative saves and full content resets.\n - status (string) (required) — Post-mortem status. `drafting` means still being edited; `published` means published. [drafting, published]\n - team_id (integer) (required) — Owning team ID. 0 if none.\n - template_id (string) (required) — Template used to initialize the report.\n - title (string) (required) — Report title.\n - updated_at_seconds (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", "Incidents.PostMortemWriteResetContent": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - generation (integer) (required) — New collaboration document generation after the reset.\n - markdown_bytes (integer) (required) — UTF-8 byte length of the accepted Markdown content.\n - markdown_sha256 (string) (required) — SHA-256 hex digest of the accepted Markdown content.\n - post_mortem_id (string) (required) — ID of the reset post-mortem report.\n - previous_generation (integer) (required) — Collaboration document generation before the reset.\n - previous_revision (integer) (required) — Content revision before the reset.\n - revision (integer) (required) — New content revision after the reset.\n", diff --git a/internal/skilldoc/incident_projection_guidance_test.go b/internal/skilldoc/incident_projection_guidance_test.go index b96bf28..1548701 100644 --- a/internal/skilldoc/incident_projection_guidance_test.go +++ b/internal/skilldoc/incident_projection_guidance_test.go @@ -15,9 +15,9 @@ func TestIncidentCardAvoidsUnboundedStructuredHotFlows(t *testing.T) { body := string(card) for description, command := range map[string]string{ - "triage list": "incident list --severity Critical --progress Triggered --since 4h --fields incident_id,title,incident_severity,progress,start_time,channel_id --output-format toon", - "triage detail": "incident detail --fields incident_id,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time,channel_id --output-format toon", - "summary detail": `incident detail "$ID" --fields incident_id,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time,channel_id --output-format toon`, + "triage list": "incident list --severity Critical --progress Triggered --since 4h --fields incident_id,num,title,incident_severity,progress,start_time,channel_id,detail_url --output-format toon", + "triage detail": "incident detail --fields incident_id,num,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time,channel_id,detail_url --output-format toon", + "summary detail": `incident detail "$ID" --fields incident_id,num,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time,channel_id,detail_url --output-format toon`, } { if !strings.Contains(body, command) { t.Errorf("incident %s must project structured output to the fields needed by the workflow", description) diff --git a/skills/flashduty/reference/incident.md b/skills/flashduty/reference/incident.md index 30f86f8..6d3522f 100644 --- a/skills/flashduty/reference/incident.md +++ b/skills/flashduty/reference/incident.md @@ -47,10 +47,10 @@ Prereq: `SKILL.md` read. Read verbs are free. **Mutating verbs notify responders ```bash # 1. Find unacknowledged critical incidents (last 4h) -fduty incident list --severity Critical --progress Triggered --since 4h --fields incident_id,title,incident_severity,progress,start_time,channel_id --output-format toon +fduty incident list --severity Critical --progress Triggered --since 4h --fields incident_id,num,title,incident_severity,progress,start_time,channel_id,detail_url --output-format toon # 2. Get AI summary + full detail (use the 24-char incident_id from step 1) -fduty incident detail --fields incident_id,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time,channel_id --output-format toon +fduty incident detail --fields incident_id,num,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time,channel_id,detail_url --output-format toon # 3. See contributing alerts fduty incident alerts @@ -79,7 +79,7 @@ Projected `similar` lists stay below 16 KiB: when the page would overflow, only `comment` never accepts the text as a command-line argument — only `--comment-file ` (or `--comment-file -` to read stdin), so backticks/`$()`/quotes inside the comment are inert. The command also reads back every target's timeline after writing and exits non-zero unless it finds an entry matching what it sent, so `Commented on ...` is proof of content fidelity, not just acceptance — no separate manual read-back is needed. Leading and trailing whitespace is stripped before sending (the server strips it too, so this is what gets stored); everything else, including interior blank lines, is preserved exactly. -> `incident list --output-format json|toon` defaults to the compact row projection `incident_id,title,incident_severity,progress,start_time,channel_id`. Pass `--fields incident_id,title,channel_id,start_time` when you need different list columns; use `incident detail ` / `incident get ` for full incident records. Any list-response field — including `labels` — is selectable this way (a key missing from the output means it wasn't selected, NOT that the server omits it; the command prints a stderr note when the default projection applies). The one exception is `alerts`: neither list nor detail responses ever fill it — use `incident alerts ` for an incident's alerts. Wide fields over many rows can exceed the 16 KiB structured-output bound; when that happens the command emits only the leading rows that fit — every value intact — and a stderr note says how many rows were emitted, so lower `--limit` or narrow `--fields` to fit more rows per page. Only when one row alone exceeds the bound does it shorten long string values (a stderr note says how many values were clipped and in which fields); if the row cannot be shortened to fit, the command errors and names the largest fields by aggregate size, so drop the field it names, or use `insight` aggregates for distributions instead of dumping labels row by row. +> `incident list --output-format json|toon` defaults to the compact row projection `incident_id,num,title,incident_severity,progress,start_time,channel_id,detail_url`. Pass `--fields incident_id,num,title,channel_id,start_time,detail_url` when you need different list columns; use `incident detail ` / `incident get ` for full incident records. Any list-response field — including `labels` — is selectable this way (a key missing from the output means it wasn't selected, NOT that the server omits it; the command prints a stderr note when the default projection applies). The one exception is `alerts`: neither list nor detail responses ever fill it — use `incident alerts ` for an incident's alerts. Wide fields over many rows can exceed the 16 KiB structured-output bound; when that happens the command emits only the leading rows that fit — every value intact — and a stderr note says how many rows were emitted, so lower `--limit` or narrow `--fields` to fit more rows per page. Only when one row alone exceeds the bound does it shorten long string values (a stderr note says how many values were clipped and in which fields); if the row cannot be shortened to fit, the command errors and names the largest fields by aggregate size, so drop the field it names, or use `insight` aggregates for distributions instead of dumping labels row by row. ## Hot flow — full fault analysis (read-only summary) @@ -95,7 +95,7 @@ If you fetch the pieces by hand instead, run **all six** — they are cheap read ```bash ID= # 24-char id from `incident list` -fduty incident detail "$ID" --fields incident_id,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time,channel_id --output-format toon # ① 详情 + AI summary + alert counts + channel +fduty incident detail "$ID" --fields incident_id,num,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time,channel_id,detail_url --output-format toon # ① 详情 + AI summary + alert counts + channel fduty incident alerts "$ID" # ② contributing alerts (detail's embedded alerts are empty here) fduty incident timeline "$ID" # ④ timeline (or `incident feed "$ID"` for the paginated view) fduty incident similar "$ID" --limit 5 --output-format toon # ⑤ similar past incidents (channel-backed; see Gotchas; compact by default) @@ -144,12 +144,12 @@ List alerts of incident - `--limit` int64 — Page size, at most 1000. (0-1000) - `--page` int64 — Page number starting at 1. (min 0) - `--search-after-ctx` string -- response: `{items: [...], total}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); alert_id (string); alert_key (string); alert_severity (string); alert_status (string); channel_id (integer); channel_name (string); channel_status (string); created_at (string); data_source_id (integer); data_source_name (string); data_source_ref_id (string); data_source_type (string); deleted_at (string); description (string); end_time (string); event_cnt (integer); events (array); ever_muted (boolean); images (array); incident (object); integration_id (integer); integration_name (string); integration_ref_id (string); integration_type (string); labels (object); last_time (string); responder_email (string); responder_name (string); start_time (string); title (string); title_rule (string); updated_at (string) +- response: `{items: [...], total}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); alert_id (string); alert_key (string); alert_severity (string); alert_status (string); channel_id (integer); channel_name (string); channel_status (string); created_at (string); data_source_id (integer); data_source_name (string); data_source_ref_id (string); data_source_type (string); deleted_at (string); description (string); detail_url (string); end_time (string); event_cnt (integer); events (array); ever_muted (boolean); images (array); incident (object); integration_id (integer); integration_name (string); integration_ref_id (string); integration_type (string); labels (object); last_time (string); responder_email (string); responder_name (string); start_time (string); title (string); title_rule (string); updated_at (string) ### alerts View incident alerts - `--limit` int -- response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: account_id (integer); alert_id (string); alert_key (string); alert_severity (string); alert_status (string); channel_id (integer); channel_name (string); channel_status (string); created_at (string); data_source_id (integer); data_source_name (string); data_source_ref_id (string); data_source_type (string); deleted_at (string); description (string); end_time (string); event_cnt (integer); events (array); ever_muted (boolean); images (array); incident (object); integration_id (integer); integration_name (string); integration_ref_id (string); integration_type (string); labels (object); last_time (string); responder_email (string); responder_name (string); start_time (string); title (string); title_rule (string); updated_at (string) +- response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: account_id (integer); alert_id (string); alert_key (string); alert_severity (string); alert_status (string); channel_id (integer); channel_name (string); channel_status (string); created_at (string); data_source_id (integer); data_source_name (string); data_source_ref_id (string); data_source_type (string); deleted_at (string); description (string); detail_url (string); end_time (string); event_cnt (integer); events (array); ever_muted (boolean); images (array); incident (object); integration_id (integer); integration_name (string); integration_ref_id (string); integration_type (string); labels (object); last_time (string); responder_email (string); responder_name (string); start_time (string); title (string); title_rule (string); updated_at (string) ### assign Assign incident @@ -500,7 +500,7 @@ Update a work item - **`update` vs `reset`**: `update ` edits title/description/severity/custom fields. `reset ` additionally supports `--impact`, `--root-cause`, `--resolution` (the AI narrative fields). Use `reset` for post-incident write-back. - **If `list` returns a `total`, use it instead of page-walking.** For "how many incidents are Triggered / Processing / Closed", run one filtered `incident list --progress ...` per bucket and read the returned `total`. Do not fetch page 1/2/3 just to derive counts the server already computed. - **Search with `--query`, don't substring-match `title` from list output.** A structured list page that exceeds its byte budget comes back reduced to the leading rows that fit (a stderr note names the emitted count), so a local `jq test()` / `contains()` over `title` only sees the emitted prefix and can miss rows that really do match, and an empty result is indistinguishable from a genuine non-match. `--query` is a server-side full-text search over title/labels/content — correct regardless of projection, and cheaper than pulling pages to filter locally. (It also resolves a 24-char `incident_id` or 6-char `num` to a direct lookup.) -- **Use `--fields` to keep list scans compact.** When the goal is to identify matching incidents or collect IDs/numbers/titles, project only the needed columns first, then fetch one target incident with `detail` / `alerts` / `timeline`. +- **Use `--fields` to keep list scans compact.** When the goal is to identify matching incidents or collect IDs/numbers/titles, project only the needed columns first, then fetch one target incident with `detail` / `alerts` / `timeline`. Keep `num` and `detail_url` in any projection or `grep`: a later sentence can link an incident only from a page URL that stayed in the output. - **`list` window cap**: `--since`/`--until` window must be < 31 days; `--limit` max 100. Empty result is authoritative — do not widen filters or retry. - **`get` has no time-window flags**: `get [...]` takes one or more incident IDs, not a window — it has no `--since`, `--until`, `--start-time`, or `--end-time` at all, so passing one errors as an unknown flag rather than filtering; use `list` for time-range filtering. - **`merge` is irreversible**: source incidents are absorbed into target permanently. Always list and confirm both IDs before running. diff --git a/skills/flashduty/scripts/incident-summary.sh b/skills/flashduty/scripts/incident-summary.sh index 2833e17..bb98d9f 100644 --- a/skills/flashduty/scripts/incident-summary.sh +++ b/skills/flashduty/scripts/incident-summary.sh @@ -27,7 +27,7 @@ fi # dump every empty field plus heavy blobs like a change's labels.steps. run() { echo "===== fduty $* ====="; fduty "$@" 2>&1; echo; } -run incident detail "$ID" --fields incident_id,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time,channel_id --output-format toon # ① 详情 + AI summary + alert counts + channel +run incident detail "$ID" --fields incident_id,num,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time,channel_id,detail_url --output-format toon # ① 详情 + AI summary + alert counts + channel run incident alerts "$ID" # ② contributing alerts run incident timeline "$ID" # ④ timeline run incident similar "$ID" --limit 5 # ⑤ similar past incidents (channel-backed)