Incidents

Incident lifecycle: creation, acknowledgement, resolution, timeline, and AI analysis mode on critical incidents.

What it's for

An incident represents an outage or a degradation. It can be opened automatically by SecuMon (when a check fails repeatedly) or manually by a member of your team. The incident centralizes the follow-up: severity, status, timeline of updates, acknowledgement and resolution. On critical incidents, an optional AI analysis mode can be enabled, with cost tracking.

The incident model

Field	Type	Description
`id`	uuid	Unique identifier.
`title`	string	Incident title (required on creation).
`description`	string	Detailed description (optional).
`severity`	string	`critical`, `major`, `minor`, `warning`, `info`… Default on manual creation: `minor`.
`status`	string	`investigating`, `acknowledged`, `resolved`… Default on creation: `investigating`.
`tags`	object	Metadata (e.g. `source: manual`).
`created_at` / `updated_at`	date	Timestamps.
`resolved_at`	date	Resolution date (present once resolved).

Lifecycle

investigating  ──► acknowledged  ──► resolved
      │                                 ▲
      └─────────────────────────────────┘

Opening: the incident appears as investigating.
Acknowledgement: an operator signals that they are taking the incident on → the status moves to acknowledged.
Updates: notes are added to the timeline as the investigation progresses.
Resolution: the incident is closed → status resolved, resolved_at filled in.

Using it from the portal

The Incidents section distinguishes open incidents from resolved incidents. For each incident, you can:

view the details and the timeline;
Acknowledge or Resolve;
add an update (note, with an optional status change);
create an incident manually;
on a critical incident, enable cloud AI mode to get an analysis, and track its cost.

View: all roles. Create, acknowledge, resolve, update, AI mode: owner, admin, operator.

Using it through the API

List open incidents

GET /api/v2/incidents

curl -s https://api.secumon.secuaas.ovh/api/v2/incidents \
  -H "Authorization: Bearer $SECUMON_TOKEN"

{
  "count": 1,
  "incidents": [
    {
      "id": "9d8c7b6a-1234-4abc-9def-001122334455",
      "title": "web-prod-01 no longer responds to ping",
      "severity": "critical",
      "status": "investigating",
      "created_at": "2026-06-23T11:58:00Z",
      "updated_at": "2026-06-23T11:58:00Z"
    }
  ]
}

View an incident

GET /api/v2/incidents/:id

curl -s https://api.secumon.secuaas.ovh/api/v2/incidents/9d8c7b6a-1234-4abc-9def-001122334455 \
  -H "Authorization: Bearer $SECUMON_TOKEN"

Create an incident manually

POST /api/v2/incidents — title required. severity (default minor) and status (default investigating) optional.

curl -s -X POST https://api.secumon.secuaas.ovh/api/v2/incidents \
  -H "Authorization: Bearer $SECUMON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Unplanned maintenance on web-prod-01",
    "description": "Restart of the application service following a memory leak.",
    "severity": "major"
  }'

Response: 201 Created with the incident (tag source: manual).

Acknowledge

Two equivalent forms:

# PUT form
curl -s -X PUT https://api.secumon.secuaas.ovh/api/v2/incidents/9d8c7b6a-1234-4abc-9def-001122334455/acknowledge \
  -H "Authorization: Bearer $SECUMON_TOKEN"

# POST form (shortcut)
curl -s -X POST https://api.secumon.secuaas.ovh/api/v2/incidents/9d8c7b6a-1234-4abc-9def-001122334455/ack \
  -H "Authorization: Bearer $SECUMON_TOKEN"

{ "status": "acknowledged" }

Resolve

Two equivalent forms (PUT .../resolve or POST .../resolve):

curl -s -X PUT https://api.secumon.secuaas.ovh/api/v2/incidents/9d8c7b6a-1234-4abc-9def-001122334455/resolve \
  -H "Authorization: Bearer $SECUMON_TOKEN"

{ "status": "resolved", "resolved_at": "2026-06-23T12:10:00Z" }

Add an update (timeline)

POST /api/v2/incidents/:id/updates — note required, status optional to change the status at the same time.

curl -s -X POST https://api.secumon.secuaas.ovh/api/v2/incidents/9d8c7b6a-1234-4abc-9def-001122334455/updates \
  -H "Authorization: Bearer $SECUMON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "note": "Cause identified: traffic spike. Mitigation in progress.", "status": "acknowledged" }'

{
  "ok": true,
  "event": {
    "time": "2026-06-23T12:05:00Z",
    "action": "update",
    "note": "Cause identified: traffic spike. Mitigation in progress.",
    "status": "acknowledged"
  }
}

AI analysis mode (critical incidents)

On an incident of critical severity, you can enable a cloud AI analysis mode with a capped budget. SecuMon logs the activation (operator, justification) and tracks the cost spent.

Enable

POST /api/v2/incidents/:id/ai-mode — body:

Field	Type	Required	Description
`provider`	string	✅	AI provider (`claude`, `openai`, `gemini`, `ovh`…).
`justification`	string	✅	Reason for the activation (max 2000 characters).
`budget_usd`	number	—	Budget. Default: 50. Cap: 200.
`operator`	string	—	Operator (inferred from your session if absent).

curl -s -X POST https://api.secumon.secuaas.ovh/api/v2/incidents/9d8c7b6a-1234-4abc-9def-001122334455/ai-mode \
  -H "Authorization: Bearer $SECUMON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "claude",
    "justification": "Critical outage in progress, need fast log analysis.",
    "budget_usd": 50
  }'

{
  "incident_id": "9d8c7b6a-1234-4abc-9def-001122334455",
  "provider": "anthropic",
  "budget_usd": 50,
  "operator": "you@example.com",
  "started_at": "2026-06-23T12:06:00Z",
  "active": true
}

The activation is refused (403) if the incident is not critical, and (400) if the justification is missing or the budget exceeds the cap.

Track the cost

GET /api/v2/incidents/:id/ai-cost

curl -s https://api.secumon.secuaas.ovh/api/v2/incidents/9d8c7b6a-1234-4abc-9def-001122334455/ai-cost \
  -H "Authorization: Bearer $SECUMON_TOKEN"

{
  "incident_id": "9d8c7b6a-1234-4abc-9def-001122334455",
  "spent_usd": 3.42,
  "budget_usd": 50,
  "active": true,
  "started_at": "2026-06-23T12:06:00Z"
}

Disable

DELETE /api/v2/incidents/:id/ai-mode

curl -s -X DELETE https://api.secumon.secuaas.ovh/api/v2/incidents/9d8c7b6a-1234-4abc-9def-001122334455/ai-mode \
  -H "Authorization: Bearer $SECUMON_TOKEN"

{ "incident_id": "9d8c7b6a-1234-4abc-9def-001122334455", "total_usd": 3.42, "status": "ended" }

Enable / disable: owner, admin, operator. Read the cost: all roles.

Use cases

On-call duty: acknowledge an incident immediately to signal you are handling it, then document the investigation through updates.
Post-mortem: the timeline of a resolved incident provides the factual chronology of the outage.
Analysis of a complex outage: enable AI mode (controlled budget) on a critical incident to speed up diagnosis.

Tips

Provide a precise justification for AI mode: it feeds traceability and facilitates cost review.
Set a budget suited to the stakes; the cost can be consulted at any time through /ai-cost, and the global cap (200) protects against overruns.
Link your incidents to a status page to automatically communicate their evolution to your users.

On this page