Skip to main content
POST
Resolve Incident
string
required
Unique incident name (e.g., INC-20260319-001)
string
default:"default"
Kubernetes namespace of the incident
string
Description of how the incident was resolved. If omitted, defaults to "Manually resolved via dashboard".Best practice: always provide a meaningful resolution message for postmortem and audit trail.

When to Use This Endpoint

This endpoint is critical in the following scenarios:

1. Escalated Incidents (Human Action Required)

When the AIOps platform exhausts all automatic remediation attempts (default: 3 retries), the incident transitions to the Escalated state. At this point:
  • The notification system alerts the on-call team via configured channels (Slack, PagerDuty, etc.)
  • The escalation policy progresses through levels (L1 β†’ L2 β†’ L3) based on timeouts
  • No further automatic remediation will be attempted
  • The incident remains in Escalated state until a human resolves it via this endpoint, the web dashboard, or the CLI

2. Manual Verification After Auto-Remediation

Even when automatic remediation succeeds, operators may want to manually verify and close the incident with additional context.

3. False Positives

When an incident is detected but the operator determines it’s a false positive, use this endpoint with a resolution like "False positive β€” metric spike caused by scheduled batch job".

Resolution Flow for Escalated Incidents

What Happens After Resolution

  1. State Change: The incident transitions from Escalated (or any active state) to Resolved
  2. Annotations Added:
    • aiops.chatcli.io/resolved-by β€” the authenticated role/user
    • aiops.chatcli.io/resolved-at β€” resolution timestamp
    • aiops.chatcli.io/manual-resolution β€” set to "true"
  3. Dedup Cache Cleared: The resource’s deduplication entry is invalidated, allowing new anomalies to be detected for the same resource
  4. PostMortem Generated: An automatic postmortem is created with the resolution details
  5. Audit Event: An immutable audit event is recorded for compliance

Authorizations

Authorization
string
header
required

Bearer token issued by the operator. Format: Authorization: Bearer <token>.

Path Parameters

name
string
required

Unique incident name.

Example:

"INC-20260319-001"

Query Parameters

namespace
string
default:default

Kubernetes namespace of the incident.

Body

application/json
resolution
string

Description of how the incident was resolved. Defaults to "Manually resolved via dashboard" when omitted.

Response

Incident resolved

apiVersion
string
Example:

"v1"

kind
string
Example:

"Incident"

metadata
object
spec
object
status
object