incident.io connector for AI agents

Tools your incident response agent reaches for on incident.io, scoped per user.

CALL ANY TOOL

111 tools for incident response in incident.io: declare and edit incidents, page responders, manage alerts and on-call schedules, publish status page updates, and track follow-ups.

incidentio_action_create

Create action

Create an action on an incident, optionally assigned to a user. Returns the created action. Use incidentio_action_create for a task to do during the incident. Use incidentio_follow_up_create for post-incident work.

Parameters

Name

Type

Required

Description

description

string

Required

Description of the action. Supports Markdown. Example: Call the fire brigade

incident_id

string

Required

Unique identifier of the incident the action belongs to. Example: 01FCNDV6P870EA6S7TK1DSYD5H

assignee_id

string

Optional

ID of the user this action is assigned to. Example: 01FCNDV6P870EA6S7TK1DSYDG0

incidentio_action_get

Get action

incidentio_action_update

Update action

incidentio_actions_list

List actions

incidentio_alert_resolve

Resolve alert

incidentio_alert_tags_add

Add alert tags

incidentio_alert_tags_remove

Remove alert tags

incidentio_alert_tags_set

Set alert tags

incidentio_catalog_entries_list

List catalog entries

incidentio_catalog_type_get

Get catalog type

incidentio_escalation_cancel

Cancel escalation

incidentio_escalation_create

Create escalation

incidentio_escalation_path_get

Get escalation path

incidentio_escalation_paths_list

List escalation paths

incidentio_incident_create

Create incident

Declare a new incident in incident.io, optionally setting severity, status, type, roles, custom fields and timestamps. Returns the created incident with its ID, reference and permalink. Use incidentio_incident_create to open a new incident. Use incidentio_incident_edit to change an existing one and incidentio_incident_update_create to post a status update. Severity, status, type, role and custom field IDs come from the matching list tools (e.g. incidentio_severities_list).

Parameters

Name

Type

Required

Description

idempotency_key

string

Required

A unique string you choose to de-duplicate this request. If you retry with the same key, incident.io returns the original result instead of creating a duplicate. Example: sk-2026-10-14-db-outage-1

visibility

string

Required

Whether the incident should be open to anyone in your Slack workspace (public), or invite-only (private). For more information on Private Incidents see our [docs](https://docs.incident.io/incidents/sensitive-incidents). One of: public, private. Example: public. One of: `public`, `private`.

custom_field_entries

array

Optional

Custom field values to set. Each entry names a custom field by its ID and gives the list of values for it; a value is a selected option ID, a catalog entry ID, free text, a number, a link or a timestamp depending on the field type. Pass an empty values list to clear a field. Look up field IDs and their options with incidentio_custom_fields_list and incidentio_custom_field_options_list. Example: [{"custom_field_id": "01FCNDV6P870EA6S7TK1DSYDG0", "values": [{"value_option_id": "01FCNDV6P870EA6S7TK1DSYDG1"}]}]

incident_role_assignments

array

Optional

People to assign to incident roles. Each item names a role by its ID and the assignee by user ID, email or Slack user ID. Find role IDs with incidentio_incident_roles_list. The reporter role can only be set when creating an incident. Example: [{"incident_role_id": "01FH5TZRWMNAFB0DZ23FD1TV96", "assignee": {"email": "bob@example.com"}}]

incident_status_id

string

Optional

Incident status to assign to the incident. Example: 01G0J1EXE7AXZ2C93K61WBPYEH

incident_timestamp_values

array

Optional

Incident timestamps to set, such as when impact started. Each item names a timestamp by its ID and gives an ISO 8601 value. Find timestamp IDs with incidentio_incident_timestamps_list. Example: [{"incident_timestamp_id": "01FCNDV6P870EA6S7TK1DSYD5H", "value": "2026-10-14T13:28:57Z"}]

incident_type_id

string

Optional

Incident type to create this incident as. Example: 01FH5TZRWMNAFB0DZ23FD1TV96

mode

string

Optional

Whether the incident is real, a test, a tutorial, or importing as a retrospective incident. One of: standard, retrospective, test, tutorial. Example: standard. One of: `standard`, `retrospective`, `test`, `tutorial`.

name

string

Optional

Explanation of the incident. Example: Our database is sad

retrospective_incident_options

object

Optional

Extra settings used only when mode is retrospective: an existing Slack channel ID to attach, a post-mortem document URL, and an external ID (the 123 in INC-123, only after agreeing it with incident.io). Example: {"postmortem_document_url": "https://docs.google.com/document/d/abc", "slack_channel_id": "C02AW36C1M5"}

severity_id

string

Optional

Severity to create incident as. Example: 01FH5TZRWMNAFB0DZ23FD1TV96

slack_channel_name_override

string

Optional

Name of the Slack channel to create for this incident. Example: inc-123-database-down

slack_team_id

string

Optional

Slack Team to create the incident in. Example: T02A1FSLE8J

summary

string

Optional

Detailed description of the incident. Example: Our database is really really sad, and we don't know why yet.

incidentio_incident_edit

Incident edit

Edit an existing incident's name, summary, severity, status, call URL, Slack channel name, role assignments, custom fields or timestamps. Only the fields you provide change. Returns the updated incident. Use incidentio_incident_edit to change incident properties. Use incidentio_incident_update_create to post a written update to responders, which can also move status or severity. The API key needs the matching per-field permission (e.g. update severity) for each property it changes.

Parameters

Name

Type

Required

Description

incident_id

string

Required

The ID of the incident to edit. Example: 01G18REBY9AYH6CMWCJ2CVCYCH

notify_incident_channel

boolean

Required

Should we send Slack channel notifications to inform responders of this update? Note that this won't work if the Slack channel has already been archived. Example: true

call_url

string

Optional

The call URL attached to this incident. Example: https://zoom.us/foo

custom_field_entries

array

Optional

incident_role_assignments

array

Optional

incident_status_id

string

Optional

Incident status to move the incident to. Allowed transitions are: - Moving between statuses within the same category (e.g. between active statuses) - Resolving an incident by moving from active/triage to a post-incident or closed status - Closing an incident from a post-incident status When resolving to a post-incident status, the incident enters the post-incident flow and tasks are created. Example: 01FCNDV6P870EA6S7TK1DSYDG0

incident_timestamp_values

array

Optional

name

string

Optional

Explanation of the incident. Example: Our database is sad

severity_id

string

Optional

The ID of the current severity of this incident. Example: 01G0J1EXE7AXZ2C93K61WBPYEH

slack_channel_name_override

string

Optional

Override the name of the incident Slack channel. Example: inc-123-database-down

summary

string

Optional

Detailed description of the incident. Example: Our database is really really sad, and we don't know why yet.

incidentio_incident_membership_revoke

Incident membership revoke

incidentio_incident_participants_list

List incident participants

incidentio_incident_role_get

Get incident role

incidentio_incident_timestamps_list

List incident timestamps

incidentio_maintenance_window_get

Get maintenance window

incidentio_notification_pauses_list

List notification pauses

incidentio_postmortem_document_status_update

Update postmortem document status

incidentio_schedule_get

Get schedule

incidentio_schedule_override_create

Create schedule override

incidentio_severities_list

List severities

incidentio_status_page_component_get

Get status page component

incidentio_status_page_incident_post_update

Update status page incident post

incidentio_status_page_structure_get

Get status page structure

incidentio_teams_list

List teams

For more tools, view docs.

Build your Agent

Same auth pattern across LangChain, OpenAI, Anthropic, and Google ADK.

import { ScalekitClient } from "@scalekit-sdk/node";
import { createReactAgent } from "@langchain/langgraph/prebuilt";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// incident.io tools scoped to this user
const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["incidentio"], toolNames: [
    "incidentio_incident_create",
    "incidentio_escalation_create",
    "incidentio_status_page_incident_create"] },
  pageSize: 100,
});

const agent = createReactAgent({ llm, tools });
await agent.invoke({ messages: [{ role: "user", content: "Declare a SEV2 incident for checkout errors, page the payments team, and post it on the status page" }] });

import OpenAI from "openai";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["incidentio"] }, pageSize: 100,
});

const res = await openai.chat.completions.create({
  model: "gpt-5",
  messages: [{ role: "user", content: "Declare a SEV2 incident for checkout errors, page the payments team, and post it on the status page" }],
  tools,
});

// Execute the tool call with the user's vaulted incident.io access token
await sk.tools.executeTool(res.choices[0].message.tool_calls[0], "user_123");

import Anthropic from "@anthropic-ai/sdk";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["incidentio"] }, pageSize: 100,
});

const msg = await anthropic.messages.create({
  model: "claude-sonnet-5",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Declare a SEV2 incident for checkout errors, page the payments team, and post it on the status page" }],
  tools,
});

// Tool call runs with the user's vaulted incident.io access token
await sk.tools.executeTool(msg.content, "user_123");

import { Agent } from "@google/adk/agents";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["incidentio"] }, pageSize: 100,
});

const agent = new Agent({
  name: "incident_response_agent",
  model: "gemini-2.5-pro",
  instruction: "incident.io tools scoped to this user",
  tools,
});

await agent.run("Declare a SEV2 incident for checkout errors, page the payments team, and post it on the status page");

Try these prompts

Copy any prompt into your agent. Each maps directly to a incident.io tool. Click to copy, paste into your agent, done.

Incidents

Copy the prompt

Copied

Declare a SEV2 incident for elevated checkout errors.

Copy the prompt

Copied

Post an update on INC-482 that the fix is deploying.

Copy the prompt

Copied

List follow-ups still open from last week's incidents.

On-call

Copy the prompt

Copied

Who is on call for the payments schedule right now?

Copy the prompt

Copied

Put Priya on call in place of Dana tonight from 6pm to midnight.

Copy the prompt

Copied

Page the database escalation path about the replication lag.

Alerts and status pages

Copy the prompt

Copied

Resolve the DiskPressure alert on db-2.

Copy the prompt

Copied

Publish a status page incident for degraded API latency.

Copy the prompt

Copied

Show uptime for the API component this month.

SEE HOW AUTH WORKS

Each user connects their own incident.io access token once, and Scalekit sends it with every call. Tokens stay vaulted, every call is scope checked, and every action is logged.

Authorize

Your user connects

incident.io

once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access

Who:

user ‘A’

when:

Once per user

access:

Limited to user

Store

Their

incident.io

token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection

vault:

encrypted

scope:

per-user

tokens:

auto-refreshed

Resolve

When your agent calls a

incident.io

tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs

speed:

~40ms

check:

before every call

seen by:

nobody

Audit

Every

incident.io

tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it

history:

90 days

export:

SIEM-ready

logged:

every call

Test other agents

See the same per-user auth pattern across other monitoring and developer tools connectors.

Engineering Teams

DevOps assistant agent

Polls GitHub for failing checks and stale PRs, opens Linear issues for the ones that need work, and posts a daily digest to Slack. It acts as the engineer, not a shared service account.

Engineering Teams

Slack triage

Polls Slack for new messages, classifies bugs and support requests with a LangGraph router, files GitHub issues or Zendesk tickets, and confirms in the thread.

Why Scalekit

Secure your agent's access. Connectors ship in minutes

01.

Shared tokens break per-user analytics

A shared incident.io access token looks fine in a demo. In production every page and incident update looks like one service account, and you cannot tell which user triggered it. Scalekit resolves the credential of the actual user who triggered the agent, never a shared bot.

// shared token
audit → bot_service_account

// scalekit
audit → user_abc ✓

02.

Authentication is not authorization

03.

Multi-tenancy is architectural

04.

incident.io today. Ten connectors tomorrow.

“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”

Venu Madhav Kattagoni

Head of Engineering / Von

FAQs

Frequently Asked Questions

Does the agent access incident.io as the user or through a shared token?

As the user. Each user connects their own incident.io access token once, and Scalekit sends it with every call. Audit logs attribute every incident change, page, and status update to that user, not a shared service account.

Where is the incident.io access token stored?

In Scalekit's managed AES-256 token vault, namespaced per tenant. To rotate it, the user reconnects with a new access token. Revocation is a single dashboard action. Credentials never appear in prompts, logs, or LLM context.

Can I limit what the agent does in incident.io?

Yes. Filter by tool name in listScopedTools to expose only what you want, for example the read and search tools without incidentio_escalation_create, which pages people, or incidentio_status_page_incident_create, which tells customers about an incident. No incident.io tool deletes data. Scalekit also enforces scope checks before every API call.

What happens when a user revokes incident.io access?

The connection is invalidated on the next tool call. Subsequent requests for that user fail closed with a clear error. Other users in the tenant remain unaffected. The event is logged for audit.

Can the agent acknowledge pages in incident.io?

Yes. incidentio_escalation_respond acknowledges or snoozes an escalation for the connected token. Declining a page is not available through the connector. incidentio_identity_get shows the token's name and roles.