---
title: "Create Incident"
method: POST
path: "/v1/incidents"
tags: ["Incidents"]
---

# Create Incident

`POST /v1/incidents`

Create new incident on given source object. If sourceAlarmId is provided, that alarm is linked to the new incident. An alarm can belong to one incident only.

## Request body

- IncidentCreate
  - `sourceObjectId` integer, required — ID of object to create the incident on.
  - `title` string, required — Incident title (cannot be empty, truncated to 255 characters).
  - `initialComment` string — Optional comment added to the new incident.
  - `sourceAlarmId` integer — Optional ID of alarm to create the incident from and link to it.

## Response `201`

Incident created.

- Incident — Full incident details
  - `id` integer — Unique incident identifier.
  - `state` integer — Incident state: 0 open, 1 in progress, 2 blocked, 3 resolved, 4 closed.
  - `stateName` string — Human-readable incident state name.
  - `title` string — Incident title (up to 255 characters).
  - `sourceObjectId` integer — ID of object the incident was created on.
  - `sourceObjectName` string — Name of the source object.
  - `assignedUserId` integer — ID of user the incident is assigned to, or 0 when unassigned.
  - `assignedUserName` string — Login name of assigned user. Unassigned incidents must be detected by testing assignedUserId for 0, not by matching on this name - user ID 0 resolves to the built-in "system" account.
  - `alarmCount` integer — Number of alarms linked to the incident.
  - `creationTime` string, date-time — Incident creation time.
  - `lastChangeTime` string, date-time — Time of last incident change.
  - `sourceAlarmId` integer — ID of alarm the incident was created from, or 0 if created manually.
  - `createdByUser` integer — ID of user who created the incident, or 0 when created by event processing rule.
  - `createdByUserName` string — Login name of creating user. Resolves to the built-in "system" account when the incident was created by an event processing rule.
  - `resolvedByUser` integer — ID of user who resolved the incident, or 0 if not resolved yet.
  - `resolvedByUserName` string — Login name of resolving user. Meaningful only when resolvedByUser is not 0.
  - `resolveTime` string, date-time, nullable — Time the incident was resolved, or null if not resolved yet.
  - `closedByUser` integer — ID of user who closed the incident, or 0 if not closed yet.
  - `closedByUserName` string — Login name of closing user. Meaningful only when closedByUser is not 0.
  - `closeTime` string, date-time, nullable — Time the incident was closed, or null if not closed yet.
  - `linkedAlarms` integer[] — IDs of alarms linked to the incident.
  - `comments` IncidentComment[] — Incident comments, oldest first.
    - `id` integer — Unique comment identifier.
    - `incidentId` integer — ID of incident the comment belongs to.
    - `userId` integer — ID of user who added the comment, or 0 for comments added by the server itself.
    - `userName` string — Login name of user who added the comment. Comments added by the server itself (AI analysis, event processing rules) carry user ID 0 and resolve to the built-in "system" account; use aiGenerated to identify AI-authored comments.
    - `creationTime` string, date-time — Comment creation time.
    - `text` string — Comment text.
    - `aiGenerated` boolean — True if the comment was generated by AI analysis.

## Other responses

- `400` — Invalid request (missing source object or empty title)
- `401` — Unauthorized
- `403` — User does not have "Manage incidents" access to source object, or no read access to source alarm
- `404` — Source object or source alarm does not exist
- `409` — Source alarm is already linked to another incident

---

[API](https://skmtc.net/netxms/apis/netxms-api.md) · [All operations](https://skmtc.net/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netxms/netxms-api/versions/14d93e5115dd/schema)