--- title: "Import an incident" method: POST path: "/api/v2/incidents/import" tags: ["Incidents"] --- # Import an incident `POST /api/v2/incidents/import` Import an incident from an external system. This endpoint allows you to create incidents with historical data such as custom timestamps for detection, declaration, and resolution. Imported incidents do not execute integrations or notification rules. ## Query parameters - `include` IncidentImportRelatedObject[] ## Request body - IncidentImportRequest — Import request for an incident. Used to import historical incidents from external systems. - `data` IncidentImportRequestData, required — Incident data for an import request. - `attributes` IncidentImportRequestAttributes, required — The incident's attributes for an import request. - `declared` string, date-time — Timestamp when the incident was declared. - `detected` string, date-time — Timestamp when the incident was detected. - `fields` object — A condensed view of the user-defined fields for which to create initial selections. - `incident_type_uuid` string — A unique identifier that represents the incident type. If not provided, the default incident type is used. - `resolved` string, date-time — Timestamp when the incident was resolved. Can only be set when the state field is set to 'resolved'. - `title` string, required — The title of the incident that summarizes what happened. - `visibility` 'organization' | 'private' — The visibility of the incident. - `relationships` IncidentImportRelationships — The relationships for an incident import request. - `commander_user` NullableRelationshipToUser, nullable — Relationship to user. - `data` NullableRelationshipToUserData, nullable, required — Relationship to user object. - `id` string, required — A unique identifier that represents the user. - `type` 'users', required — Users resource type. - `declared_by_user` NullableRelationshipToUser, nullable — Relationship to user. - `data` NullableRelationshipToUserData, nullable, required — Relationship to user object. - `id` string, required — A unique identifier that represents the user. - `type` 'users', required — Users resource type. - `type` 'incidents', required — Incident resource type. ## Response `201` CREATED - IncidentImportResponse — Response with an incident. - `data` IncidentImportResponseData, required — Incident data from an import response. - `attributes` IncidentImportResponseAttributes — The incident's attributes from an import response. - `archived` string, date-time, nullable — Timestamp when the incident was archived. - `case_id` integer, nullable — The incident case ID. - `created` string, date-time — Timestamp when the incident was created. - `created_by_uuid` string, nullable — UUID of the user who created the incident. - `creation_idempotency_key` string, nullable — A unique key used to ensure idempotent incident creation. - `customer_impact_end` string, date-time, nullable — Timestamp when customers were no longer impacted by the incident. - `customer_impact_scope` string, nullable — A summary of the impact customers experienced during the incident. - `customer_impact_start` string, date-time, nullable — Timestamp when customers began to be impacted by the incident. - `declared` string, date-time, nullable — Timestamp when the incident was declared. - `declared_by_uuid` string, nullable — UUID of the user who declared the incident. - `detected` string, date-time, nullable — Timestamp when the incident was detected. - `fields` object — A condensed view of the user-defined fields attached to incidents. - `incident_type_uuid` string — A unique identifier that represents an incident type. - `is_test` boolean — A flag indicating whether the incident is a test incident. - `last_modified_by_uuid` string, nullable — UUID of the user who last modified the incident. - `modified` string, date-time — Timestamp when the incident was last modified. - `non_datadog_creator` IncidentNonDatadogCreator, nullable — Incident's non Datadog creator. - `image_48_px` string — Non Datadog creator `48px` image. - `name` string — Non Datadog creator name. - `notification_handles` IncidentNotificationHandle[], nullable — Notification handles that are notified of the incident during update. - `display_name` string — The name of the notified handle. - `handle` string — The handle used for the notification. This includes an email address, Slack channel, or workflow. - `public_id` integer — The monotonically increasing integer ID for the incident. - `resolved` string, date-time, nullable — Timestamp when the incident's state was last changed from active or stable to resolved or completed. - `severity` 'UNKNOWN' | 'SEV-0' | 'SEV-1' | 'SEV-2' | 'SEV-3' | 'SEV-4' | 'SEV-5' — The incident severity. - `state` string, nullable — The state of the incident. - `title` string, required — The title of the incident that summarizes what happened. - `visibility` string, nullable — The incident visibility status. - `id` string, required — The incident's ID. - `relationships` IncidentImportResponseRelationships — The incident's relationships from an import response. - `attachments` RelationshipToIncidentAttachment — A relationship reference for attachments. - `data` RelationshipToIncidentAttachmentData[], required — An array of incident attachments. - `id` string, required — A unique identifier that represents the attachment. - `type` 'incident_attachments', required — The incident attachment resource type. - `commander_user` NullableRelationshipToUser, nullable — Relationship to user. - `data` NullableRelationshipToUserData, nullable, required — Relationship to user object. - `id` string, required — A unique identifier that represents the user. - `type` 'users', required — Users resource type. - `created_by_user` RelationshipToUser — Relationship to user. - `data` RelationshipToUserData, required — Relationship to user object. - `id` string, required — A unique identifier that represents the user. - `type` 'users', required — Users resource type. - `declared_by_user` RelationshipToUser — Relationship to user. - `data` RelationshipToUserData, required — Relationship to user object. - `id` string, required — A unique identifier that represents the user. - `type` 'users', required — Users resource type. - `impacts` RelationshipToIncidentImpacts — Relationship to impacts. - `data` RelationshipToIncidentImpactData[], required — An array of incident impacts. - `id` string, required — A unique identifier that represents the impact. - `type` 'incident_impacts', required — The incident impacts type. - `incident_type` RelationshipToIncidentType — Relationship to an incident type. - `data` RelationshipToIncidentTypeData, required — Relationship to incident type object. - `id` string, required — The incident type's ID. - `type` 'incident_types', required — Incident type resource type. - `integrations` RelationshipToIncidentIntegrationMetadatas — A relationship reference for multiple integration metadata objects. - `data` RelationshipToIncidentIntegrationMetadataData[], required — Integration metadata relationship array - `id` string, required — A unique identifier that represents the integration metadata. - `type` 'incident_integrations', required — Integration metadata resource type. - `last_modified_by_user` RelationshipToUser — Relationship to user. - `data` RelationshipToUserData, required — Relationship to user object. - `id` string, required — A unique identifier that represents the user. - `type` 'users', required — Users resource type. - `responders` RelationshipToIncidentResponders — Relationship to incident responders. - `data` RelationshipToIncidentResponderData[], required — An array of incident responders. - `id` string, required — A unique identifier that represents the responder. - `type` 'incident_responders', required — The incident responders type. - `user_defined_fields` RelationshipToIncidentUserDefinedFields — Relationship to incident user defined fields. - `data` RelationshipToIncidentUserDefinedFieldData[], required — An array of user defined fields. - `id` string, required — A unique identifier that represents the responder. - `type` 'user_defined_field', required — The incident user defined fields type. - `type` 'incidents', required — Incident resource type. - `included` IncidentImportResponseIncludedItem[] — Included related resources that the user requested. - union — An object related to an incident that is included in the response. - IncidentUserData — User object returned by the API. - `attributes` IncidentUserAttributes — Attributes of user object returned by the API. - `email` string — Email of the user. - `handle` string — Handle of the user. - `icon` string — URL of the user's icon. - `name` string, nullable — Name of the user. - `uuid` string — UUID of the user. - `id` string — ID of the user. - `type` 'users' — Users resource type. - IncidentTypeObject — Incident type response data. - `attributes` IncidentTypeAttributes — Incident type's attributes. - `configuration` IncidentTypeConfiguration — The incident-type-scoped behavior settings. All fields are optional on update. Any field omitted from a PATCH request keeps its current value. This object is read-only on the incident type resource itself and is only mutated through the update (PATCH) endpoint. - `allow_incident_deletion` boolean — Whether incidents of this type can be deleted. - `allow_workflows` boolean — Whether automation workflows can be triggered for incidents of this type. - `create_message` string — An optional message shown to users when they declare an incident of this type. - `editable_timestamps` boolean — Whether responders can edit incident timestamps for incidents of this type. - `private_incidents` boolean — Whether responders can create private incidents of this type. This is an opt-in setting, distinct from `private_incidents_by_default`, which controls whether incidents are created private automatically. - `private_incidents_by_default` boolean — Whether incidents of this type are created as private by default. - `slug_source` 'default' | 'servicenow' — When set to `servicenow`, incidents will display the ServiceNow record ID instead of the public ID. If no ServiceNow integration exists, the public ID will be displayed. - `test_incidents` boolean — Whether incidents of this type are treated as test incidents. - `createdAt` string, date-time — Timestamp when the incident type was created. - `createdBy` string — A unique identifier that represents the user that created the incident type. - `description` string — Text that describes the incident type. - `is_default` boolean — If true, this incident type will be used as the default incident type if a type is not specified during the creation of incident resources. - `lastModifiedBy` string — A unique identifier that represents the user that last modified the incident type. - `modifiedAt` string, date-time — Timestamp when the incident type was last modified. - `name` string, required — The name of the incident type. - `prefix` string — The string that will be prepended to the incident title across the Datadog app. - `id` string, required — The incident type's ID. - `relationships` IncidentTypeRelationships — The incident type's resource relationships. - `created_by_user` RelationshipToUser — Relationship to user. - `data` RelationshipToUserData, required — Relationship to user object. - … - `google_meet_configuration` GoogleMeetConfigurationReference, nullable — A reference to a Google Meet Configuration resource. - `data` GoogleMeetConfigurationReferenceData, nullable, required — The Google Meet configuration relationship data object. - … - `last_modified_by_user` RelationshipToUser — Relationship to user. - `data` RelationshipToUserData, required — Relationship to user object. - … - `microsoft_teams_configuration` MicrosoftTeamsConfigurationReference, nullable — A reference to a Microsoft Teams Configuration resource. - `data` MicrosoftTeamsConfigurationReferenceData, nullable, required — The Microsoft Teams configuration relationship data object. - … - `zoom_configuration` ZoomConfigurationReference, nullable — A reference to a Zoom configuration resource. - `data` ZoomConfigurationReferenceData, nullable, required — The Zoom configuration relationship data object. - … - `type` 'incident_types', required — Incident type resource type. ## Other responses - `400` — Bad Request - `401` — Unauthorized - `403` — Forbidden - `404` — Not Found - `429` — Too many requests --- [API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)