--- title: Datadog V2 slug: connectors/datadog-v2 docTags: createdAt: 2026-06-09T16:30:07.917Z --- Datadog V2 provides advanced monitoring and analytics capabilities for managing incidents and events across your organization's infrastructure. Datadog is a comprehensive monitoring and security platform for cloud applications. The Datadog V2 connector allows Swimlane Turbine users to seamlessly integrate with Datadog's incident management and event monitoring capabilities. This integration enables users to automate the creation, updating, and deletion of incidents, as well as search and retrieve events and incidents, enhancing the efficiency and effectiveness of security operations. By leveraging Datadog's robust API, users can streamline incident response workflows, ensuring timely and informed decision-making. ## Prerequisites Before you can use the Datadog V2 connector for Turbine, you'll need access to the Datadog API. This requires the following: - an API key authentication using the following parameters: - API Key: A unique key provided by Datadog for authenticating API requests. - URL: The endpoint URL for accessing Datadog's API services. ## Capabilities This connector provides the following capabilities: Search Events Create Incident Delete Incident List Incident Search Incidents Update Incidents ### Limitations Currently no limitations on the Datadog integration and API. ## Asset Setup Datadog requires both an API key and an application key for full access to Datadog's programmatic API. Thus without both keys this integration will not connect successfully. ## Notes For more information on Datadog: [Datadog API Documentation](https://docs.datadoghq.com/api/?lang=bash#api-reference) [Complete list of source attribute values](https://docs.datadoghq.com/integrations/faq/list-of-api-source-attribute-value/) ## Additional Documentation - [Datadog V2 Connector Documentation](https://docs.swimlane.com/connectors/datadog-v2) - [Datadog V2 API Documentation](https://docs.datadoghq.com/api/?lang=bash#api-reference) # Configurations ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------------ | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | DD-API-KEY | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | | DD-APPLICATION-KEY | Application Key | string | Optional | # Actions ## Incident Create Create an incident in Datadog V2 using the incident\_write authorization scope. Requires JSON body with data. ### Endpoint - **URL:** `api/v2/incidents` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------ | | `data` | object | Optional | Response data | | `data.type` | string | Required | Incident data for a create request. | | `data.attributes` | object | Required | The incident's attributes for a create request. | | `data.attributes.title` | string | Required | The title of the incident, which summarizes what happened. | | `data.attributes.customer_impacted` | boolean | Required | A flag indicating whether the incident caused customer impact. | | `data.attributes.customer_impact_scope` | string | Optional | Required if customer\_impacted:"true". A summary of the impact customers experienced during the incident. | | `data.attributes.fields` | object | Optional | A condensed view of the user-defined fields for which to create initial selections. | | `data.attributes.fields.state` | object | Optional | Response data | | `data.attributes.fields.state.type` | string | Optional | Type of the single value field definitions. Allowed enum values are dropdown,textbox and default is dropdown | | `data.attributes.fields.state.value` | string | Optional | The single value selected for this field. | | `data.attributes.initial_cells` | array | Optional | An array of initial timeline cells to be placed at the beginning of the incident timeline. | | `data.attributes.initial_cells.cell_type` | string | Required | Type of the Markdown timeline cell. Allowed enum values are markdown, default is markdown | | `data.attributes.initial_cells.content` | object | Required | The Markdown timeline cell contents. | | `data.attributes.initial_cells.content.content` | string | Optional | The Markdown content of the cell. | | `data.attributes.initial_cells.content.important` | boolean | Optional | A flag indicating whether the timeline cell is important and should be highlighted. | | `data.attributes.notification_handles` | array | Optional | Notification handles that will be notified of the incident at creation. | | `data.attributes.notification_handles.display_name` | string | Optional | The name of the notified handle. | | `data.attributes.notification_handles.handle` | string | Optional | The email address used for the notification. | | `data.relationships` | object | Optional | The relationships the incident will have with other resources once created. | | `data.relationships.commander_user` | object | Optional | Relationship to user. | | `data.relationships.commander_user.data` | object | Optional | Relationship to user object. | | `data.relationships.commander_user.data.type` | string | Optional | Users resource type. Allowed enum values are users, default is users | | `data.relationships.commander_user.data.id` | string | Optional | A unique identifier that represents the user. | ### Input Example `{"data":{"type":"string","attributes":{"title":"string","customer_impacted":true,"customer_impact_scope":"string","fields":{"state":{}},"initial_cells":[{"cell_type":"string","content":{}}],"notification_handles":[{"display_name":"Example Name","handle":"string"}]},"relationships":{"commander_user":{"data":{}}}}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Incident data from a response. | | `data.attributes` | object | The incident's attributes from a response. | | `data.attributes.created` | string | Timestamp when the incident was created | | `data.attributes.customer_impact_duration` | string | Length of the incident's customer impact in seconds. Equals the difference between customer\_impact\_start and customer\_impact\_end | | `data.attributes.customer_impact_end` | string | Timestamp when customers were no longer impacted by the incident. | | `data.attributes.customer_impact_scope` | string | Response data | | `data.attributes.customer_impact_start` | string | Timestamp when customers began being impacted by the incident. | | `data.attributes.customer_impacted` | boolean | A flag indicating whether the incident caused customer impact. | | `data.attributes.detected` | string | Timestamp when the incident was detected. | | `data.attributes.fields` | object | A condensed view of the user-defined fields attached to incidents. | | `data.attributes.fields.` | string | Dynamic fields for which selections can be made, with field names as keys | | `data.attributes.modified` | string | Timestamp when the incident was last modified. | | `data.attributes.notification_handles` | array | Notification handles that will be notified of the incident during update. | | `data.attributes.notification_handles.display_name` | string | The name of the notified handle. | | `data.attributes.notification_handles.handle` | string | The email address used for the notification. | | `data.attributes.public_id` | number | The monotonically increasing integer ID for the incident. | | `data.attributes.resolved` | string | Timestamp when the incident's state was last changed from active or stable to resolved or completed. | | `data.attributes.time_to_detect` | string | The amount of time in seconds to detect the incident. Equals the difference between customer\_impact\_start and detected. | | `data.attributes.time_to_internal_response` | string | The amount of time in seconds to call incident after detection. Equals the difference of detected and created. | | `data.attributes.time_to_repair` | string | The amount of time in seconds to resolve customer impact after detecting the issue. Equals the difference between customer\_impact\_end and detected. | | `data.attributes.time_to_resolve` | string | The amount of time in seconds to resolve the incident after it was created. Equals the difference between created and resolved | | `data.attributes.title` | string | The title of the incident, which summarizes what happened. | | `data.id` | string | The incident's ID. | ### Output Example `{"status_code":201,"response_headers":{"Date":"Wed, 06 Sep 2023 17:59:56 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","x-frame-options":"SAMEORIGIN","content-security-policy":"frame-ancestors 'self'; report-uri https://logs.browser-intake-datadoghq.com/api...","vary":"Accept-Encoding","content-encoding":"gzip","x-ratelimit-limit":"20","x-ratelimit-period":"60","x-ratelimit-remaining":"19","x-ratelimit-reset":"4","x-ratelimit-name":"incidents_crea...` ## Delete Incident Remove an existing incident from your organization in Datadog V2. Requires the incident\_id path parameter and incident\_write authorization scope. ### Endpoint - **URL:** `api/v2/incidents/{{incident_id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ------------------------- | | `path_parameters.incident_id` | string | Required | The UUID of the incident. | ### Input Example `{"path_parameters":{"incident_id":"73e9f627-5dd6-526f-b658-6e89b7e2e438"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":204,"response_headers":{"Date":"Wed, 06 Sep 2023 18:10:23 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","x-frame-options":"SAMEORIGIN","content-security-policy":"frame-ancestors 'self'; report-uri https://logs.browser-intake-datadoghq.com/api...","vary":"Accept-Encoding","content-encoding":"gzip","x-ratelimit-limit":"20","x-ratelimit-period":"60","x-ratelimit-remaining":"19","x-ratelimit-reset":"37","x-ratelimit-name":"incidents_del...` ## List Incidents Retrieve all incidents for the user's organization in Datadog V2. Requires incident\_read authorization scope. ### Endpoint - **URL:** `api/v2/incidents` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ---------------------------------------------------------------------------- | | `parameters.include` | array | Optional | Specifies which types of related objects should be included in the response. | | `parameters.page_size` | number | Optional | Size for a given page. The maximum allowed value is 100. | | `parameters.page_offset` | number | Optional | Specific offset to use as the beginning of the returned page. | ### Input Example `{"parameters":{"include":["string"],"page_size":123,"page_offset":123}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | An array of incidents. | | `data.type` | string | Incident resource type. Allowed enum values is incidents and default is incidents | | `data.id` | string | The incident's ID. | | `data.attributes` | object | The incident's attributes from a response. | | `data.attributes.public_id` | number | The monotonically increasing integer ID for the incident. | | `data.attributes.incident_type_uuid` | number | Response data | | `data.attributes.title` | string | The title of the incident, which summarizes what happened | | `data.attributes.resolved` | string | Timestamp when the incident's state was last changed from active or stable to resolved or completed. | | `data.attributes.customer_impact_end` | string | Timestamp when customers were no longer impacted by the incident. | | `data.attributes.customer_impact_scope` | string | A summary of the impact customers experienced during the incident. | | `data.attributes.customer_impact_start` | string | Timestamp when customers began being impacted by the incident. | | `data.attributes.customer_impacted` | boolean | A flag indicating whether the incident caused customer impact | | `data.attributes.notification_handles` | array | Notification handles that will be notified of the incident during update. | | `data.attributes.notification_handles.display_name` | string | The name of the notified handle. | | `data.attributes.notification_handles.handle` | string | The email address used for the notification. | | `data.attributes.last_modified_by_uuid` | string | Response data | | `data.attributes.created` | string | Timestamp when the incident was created. | | `data.attributes.modified` | string | Timestamp when the incident was last modified. | | `data.attributes.detected` | string | Timestamp when the incident was detected. | | `data.attributes.created_by_uuid` | string | Response data | | `data.attributes.creation_idempotency_key` | number | Response data | | `data.attributes.customer_impact_duration` | number | Length of the incident's customer impact in seconds. Equals the difference between customer\_impact\_start and customer\_impact\_end. | | `data.attributes.time_to_detect` | number | The amount of time in seconds to detect the incident. Equals the difference between customer\_impact\_start and detected. | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 07 Sep 2023 09:44:07 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","x-frame-options":"SAMEORIGIN","content-security-policy":"frame-ancestors 'self'; report-uri https://logs.browser-intake-datadoghq.com/api...","vary":"Accept-Encoding","content-encoding":"gzip","x-ratelimit-limit":"100","x-ratelimit-period":"60","x-ratelimit-remaining":"99","x-ratelimit-reset":"53","x-ratelimit-name":"incidents_ge...` ## Seacrh Events Retrieve events matching a search query in Datadog V2 with pagination support. Requires events\_read authorization scope for complex filtering and search. ### Endpoint - **URL:** `api/v2/events/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | `filter` | object | Optional | The search and filter query settings. | | `filter.from` | string | Optional | The minimum time for the requested events. Supports date math and regular timestamps in milliseconds. Default is now-15m | | `filter.query` | string | Optional | The search query following the event search syntax. Default is \* | | `filter.to` | string | Optional | The maximum time for the requested events. Supports date math and regular timestamps in milliseconds. Default is now | | `options` | object | Optional | The global query options that are used. Either provide a timezone or a time offset but not both, otherwise the query fails. | | `options.timeOffset` | number | Optional | The time offset to apply to the query in seconds. | | `options.timezone` | string | Optional | The timezone can be specified as GMT, UTC, an offset from UTC (like UTC+1), or as a Timezone Database identifier (like America/New\_York).Default is UTC | | `page` | object | Optional | Pagination settings. | | `page.cursor` | string | Optional | The returned paging point to use to get the next results. | | `page.limit` | number | Optional | The maximum number of logs in the response. Default is 10 | | `sort` | string | Optional | The sort parameters when querying events. Allowed enum values are timestamp,-timestamp | ### Input Example `{"filter":{"from":"string","query":"string","to":"string"},"options":{"timeOffset":123,"timezone":"string"},"page":{"cursor":"string","limit":123},"sort":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | An array of events matching the request. | | `data.attributes` | object | The object description of an event response attribute. | | `data.attributes.attributes` | object | Object description of attributes from your event. | | `data.attributes.attributes.aggregation_key` | string | Aggregation key of the event. | | `data.attributes.attributes.date_happened` | number | POSIX timestamp of the event. Must be sent as an integer (no quotation marks). Limited to events no older than 18 hours. | | `data.attributes.attributes.device_name` | string | A device name. | | `data.attributes.attributes.duration` | number | The duration between the triggering of the event and its recovery in nanoseconds. | | `data.attributes.attributes.event_object` | string | The event title. | | `data.attributes.attributes.evt` | object | The metadata associated with a request. | | `data.attributes.attributes.evt.id` | string | Event ID. | | `data.attributes.attributes.evt.name` | string | The event name. | | `data.attributes.attributes.evt.source_id` | number | Event source ID. | | `data.attributes.attributes.evt.type` | string | Event type. | | `data.attributes.attributes.hostname` | string | Host name to associate with the event. Any tags associated with the host are also applied to this event. | | `data.attributes.attributes.monitor` | object | Attributes from the monitor that triggered the event. | | `data.attributes.attributes.monitor.created_at` | number | The POSIX timestamp of the monitor's creation in nanoseconds. | | `data.attributes.attributes.monitor.group_status` | number | Monitor group status used when there is no result\_groups. | | `data.attributes.attributes.monitor.groups` | array | Groups to which the monitor belongs. | | `data.attributes.attributes.monitor.id` | number | The monitor ID. | | `data.attributes.attributes.monitor.message` | string | The monitor message. | | `data.attributes.attributes.monitor.modified` | number | The monitor's last-modified timestamp. | | `data.attributes.attributes.monitor.name` | string | The monitor name. | | `data.attributes.attributes.monitor.query` | string | The query that triggers the alert. | ### Output Example `{"data":[{"attributes":{},"id":"AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA","type":"event"}],"links":{"next":"https://app.datadoghq.com/api/v2/events?filter[query]=foo&page[cursor]=eyJzdGFyd..."},"meta":{"elapsed":132,"page":{"after":"eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxD..."},"request_id":"MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR","status":"done","warnings":[{}]}}` ## Search Incidents Search for incidents in Datadog V2 matching a specific query. Requires incident\_read authorization scope and query parameter. ### Endpoint - **URL:** `api/v2/incidents/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.include` | string | Optional | Specifies which types of related objects should be included in the response. Allowed enum values are users, attachments | | `parameters.query` | string | Required | Specifies which incidents should be returned. After entering a search query in your Incidents page, use the query parameter value in the URL of the page as the value for this parameter. The query can contain any number of incident facets joined by ANDs, along with multiple values for each of those facets joined by ORs, | | `parameters.sort` | string | Optional | Specifies the order of returned incidents. Allowed enum values are created, -created | | `parameters.page_size` | number | Optional | Size for a given page. The maximum allowed value is 100. | | `parameters.page_offset` | number | Optional | Specific offset to use as the beginning of the returned page. | ### Input Example `{"parameters":{"include":"string","query":"string","sort":"string","page_size":123,"page_offset":123}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | ----------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Data returned by an incident search. | | `data.attributes` | object | Attributes returned by an incident search. | | `data.attributes.facets` | object | Facet data for incidents returned by a search query. | | `data.attributes.facets.commander` | array | Facet data for incident commander users. | | `data.attributes.facets.commander.count` | number | Count of the facet value appearing in search results. | | `data.attributes.facets.commander.email` | string | Email of the user. | | `data.attributes.facets.commander.handle` | string | Handle of the user. | | `data.attributes.facets.commander.name` | string | Name of the user. | | `data.attributes.facets.commander.uuid` | string | ID of the user. | | `data.attributes.facets.created_by` | array | Facet data for incident creator users. | | `data.attributes.facets.created_by.count` | number | Count of the facet value appearing in search results. | | `data.attributes.facets.created_by.email` | string | Email of the user. | | `data.attributes.facets.created_by.handle` | string | Handle of the user. | | `data.attributes.facets.created_by.name` | string | Name of the user. | | `data.attributes.facets.created_by.uuid` | string | ID of the user. | | `data.attributes.facets.fields` | array | Facet data for incident property fields. | | `data.attributes.facets.fields.aggregates` | object | Aggregate information for numeric incident data. | | `data.attributes.facets.fields.facets` | array | Facet data for the property field of an incident. | | `data.attributes.facets.fields.name` | string | Name of the incident property field. | | `data.attributes.facets.impact` | array | Facet data for incident impact attributes. | | `data.attributes.facets.impact.count` | number | Count of the facet value appearing in search results. | | `data.attributes.facets.impact.name` | string | The facet value appearing in search results. | | `data.attributes.facets.last_modified_by` | array | Facet data for incident last modified by users. | ### Output Example `{"data":{"attributes":{"facets":{},"incidents":[],"total":123},"type":"string"},"included":[{"attributes":{},"id":"12345678-1234-1234-1234-123456789abc","relationships":{},"type":"string"}],"meta":{"pagination":{"next_offset":123,"offset":123,"size":123}}}` ## Update Incident Update an incident in Datadog V2 with specified attributes using partial update. Requires incident\_id and data, along with incident\_write authorization scope. ### Endpoint - **URL:** `api/v2/incidents/{{incident_id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------- | | `path_parameters.incident_id` | string | Required | The UUID of the incident. | | `parameters.include` | array | Optional | Specifies which types of related objects should be included in the response. | | `data` | object | Optional | Incident data for an update request. | | `data.attributes` | object | Optional | The incident's attributes for an update request. | | `data.attributes.customer_impact_end` | string | Optional | Timestamp when customers were no longer impacted by the incident. | | `data.attributes.customer_impact_scope` | string | Optional | A summary of the impact customers experienced during the incident. | | `data.attributes.customer_impact_start` | string | Optional | Timestamp when customers began being impacted by the incident. | | `data.attributes.customer_impacted` | boolean | Optional | A flag indicating whether the incident caused customer impact. | | `data.attributes.detected` | string | Optional | Timestamp when the incident was detected. | | `data.attributes.fields` | object | Optional | A condensed view of the user-defined fields for which to update selections. | | `data.attributes.fields.` | string | Optional | Dynamic fields for which selections can be made, with field names as keys. | | `data.attributes.notification_handles` | array | Optional | Notification handles that will be notified of the incident during update. | | `data.attributes.notification_handles.display_name` | string | Optional | The name of the notified handle. | | `data.attributes.notification_handles.handle` | string | Optional | The email address used for the notification. | | `data.attributes.title` | string | Optional | The title of the incident, which summarizes what happened. | | `data.id` | string | Required | The incident's ID. | | `data.relationships` | object | Required | The incident's relationships for an update request. | | `data.relationships.commander_user` | object | Required | Relationship to user. | | `data.relationships.commander_user.data` | object | Required | Relationship to user object. | | `data.relationships.commander_user.data.id` | string | Required | A unique identifier that represents the user. | | `data.relationships.commander_user.data.type` | string | Required | Users resource type. Allowed enum values is users and default is users | | `data.relationships.integrations` | object | Required | A relationship reference for multiple integration metadata objects. | | `data.relationships.integrations.data` | array | Required | Integration metadata relationship array | | `data.relationships.integrations.data.id` | string | Required | A unique identifier that represents the integration metadata. | | `data.relationships.integrations.data.type` | string | Required | Integration metadata resource type. Allowed enum values:= incident\_integrations and default is incident\_integrations | ### Input Example `{"parameters":{"include":["commander_user","incident"]},"path_parameters":{"incident_id":"73e9f627-5dd6-526f-b658-6e89b7e2e438"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Incident data from a response. | | `data.attributes` | object | The incident's attributes from a response. | | `data.attributes.created` | string | Timestamp when the incident was created. | | `data.attributes.customer_impact_duration` | integer | Length of the incident's customer impact in seconds. Equals the difference between customer\_impact\_start and customer\_impact\_end. | | `data.attributes.customer_impact_end` | string | Timestamp when customers were no longer impacted by the incident. | | `data.attributes.customer_impact_scope` | string | A summary of the impact customers experienced during the incident. | | `data.attributes.customer_impact_start` | string | Timestamp when customers began being impacted by the incident. | | `data.attributes.customer_impacted` | boolean | A flag indicating whether the incident caused customer impact. | | `data.attributes.detected` | string | Timestamp when the incident was detected. | | `data.attributes.fields` | object | A condensed view of the user-defined fields attached to incidents. | | `data.attributes.fields.` | string | Dynamic fields for which selections can be made, with field names as keys. | | `data.attributes.modified` | string | Timestamp when the incident was last modified. | | `data.attributes.notification_handles` | array | Notification handles that will be notified of the incident during update. | | `data.attributes.notification_handles.display_name` | string | The name of the notified handle. | | `data.attributes.notification_handles.handle` | string | The email address used for the notification. | | `data.attributes.public_id` | number | The monotonically increasing integer ID for the incident. | | `data.attributes.resolved` | string | Timestamp when the incident's state was last changed from active or stable to resolved or completed. | | `data.attributes.time_to_detect` | string | The amount of time in seconds to detect the incident. Equals the difference between customer\_impact\_start and detected. | | `data.attributes.time_to_internal_response` | string | The amount of time in seconds to call incident after detection. Equals the difference of detected and created. | | `data.attributes.time_to_repair` | string | The amount of time in seconds to resolve customer impact after detecting the issue. Equals the difference between customer\_impact\_end and detected. | | `data.attributes.time_to_resolve` | string | The amount of time in seconds to resolve the incident after it was created. Equals the difference between created and resolved | | `data.attributes.title` | string | The title of the incident, which summarizes what happened. | | `data.id` | string | The incident's ID. | ### Output Example `{"data":{"attributes":{"created":"2024-01-01T00:00:00Z","customer_impact_duration":123,"customer_impact_end":"string","customer_impact_scope":"string","customer_impact_start":"string","customer_impacted":true,"detected":"string","fields":{},"modified":"string","notification_handles":[],"public_id":123,"resolved":"string","time_to_detect":"string","time_to_internal_response":"string","time_to_repair":"string"},"id":"12345678-1234-1234-1234-123456789abc","relationships":{"attachments":{},"commande...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ----------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Connection | HTTP response header: Connection | keep-alive | | content-encoding | HTTP response header: content-encoding | gzip | | Content-Length | The length of the response body in bytes | 19 | | content-security-policy | HTTP response header: content-security-policy | frame-ancestors 'self'; report-uri [https://logs.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pube4f163c23bbf91c16b8f57f56af9fc58\&dd-evp-origin=content-security-policy\&ddsource=csp-report\&ddtags=site%3Adatadoghq.com](https://logs.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pube4f163c23bbf91c16b8f57f56af9fc58\&dd-evp-origin=content-security-policy\&ddsource=csp-report\&ddtags=site%3Adatadoghq.com) | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 07 Sep 2023 09:44:07 GMT | | strict-transport-security | HTTP response header: strict-transport-security | max-age=31536000; includeSubDomains; preload | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | vary | HTTP response header: vary | Accept-Encoding | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | x-frame-options | HTTP response header: x-frame-options | SAMEORIGIN | | x-ratelimit-limit | The number of requests allowed in the current rate limit window | 20 | | x-ratelimit-name | HTTP response header: x-ratelimit-name | incidents\_get\_incident\_list | | x-ratelimit-period | HTTP response header: x-ratelimit-period | 60 | | x-ratelimit-remaining | The number of requests remaining in the current rate limit window | 19 | | x-ratelimit-reset | The time at which the current rate limit window resets | 37 |