Preserve incident acknowledgements list after it has been resolved/triggered

#1

Hi, in the get incidents api the list of acknowledgements gets cleared after it has been resolved/triggered, why is that?

Can we please preserve the list of acknowledgements, we need this data for our reporting

1 Like
#2

The acknowledgment on the incident object itself is representative of who is currently working on an incident. When an incident is resolved, or when it is in the triggered state, it is assumed that no one is. This can change over the course of an incident’s lifecycle.

The historical data for an incident including who acknowledged it are available as log entries via the list log entries for an incident endpoint.

What you can do to get specifically the list of users who have acknowledged an incident is filter the results after fetching the full list down with the criteria:

  • type property is acknowledge_log_entry
  • agent.type property is user_reference

The agent.id property is then the ID of the user who acknowledged it.

A python example that results in a list of 2-tuples with the time stamp and user ID that acknowledged:

# >>> session.__class__
# <class 'pdpyras.APISession'>
log_entries = filter(
    lambda ile: ile['type'] == 'acknowledge_log_entry' and ile['agent']['type'] == 'user_reference',
    session.iter_all('/incidents/Q3A9D8N98E9W8H/log_entries')
)
ack_users_times = [(ile['created_at'], ile['agent']['id']) for ile in log_entries]
# >>> ack_users_times
# [('2023-05-18T15:45:00Z', 'PZES9245'), ... ]
#3

We have thousands of incidents and are also hitting the status_updates and notes endpoints for each incident. We are already frequently hitting 429s. Adding another api that calls each individual incident is not an optimal long term solution. Surely there’s another way to get all of this data without the need to call on so many different APIs

#4

If you’re looking for incident acknowledgments and other historical details of incidents that don’t translate to the current status of any given incident, a way to do this without doing it separately for every incident is to use the log entries API directly, getting up to 100 records per request.

Each log entry has an incident reference in it that has the incident ID in it, which can then be used to identify incidents and populate data on them. Notes have type = annotate_log_entry but I’m not sure how to detect status updates (they may not go in as log entries, or their log entry type is not yet documented).

Also, if you don’t mind sharing more information about the use case, there may be other ways we can help.