---
title: "Investigation V2"
method: POST
path: "/v2/investigation/new"
---

# Investigation V2

`POST /v2/investigation/new`

Unified investigation endpoint that accepts thinking_mode parameter.

The thinking_mode parameter determines how the investigation is conducted:
- AUTO: Uses message classifier to determine RCA vs CHAT investigation
- DEEP: Forces RCA (root cause analysis) investigation
- FAST: Forces CHAT (exploratory) investigation

The endpoint does not hardcode the session mode; it uses thinking_mode to
determine behavior.

## Request body

- InvestigationRequest — Model for the investigation request payload.
  - `files` RequestFile[]
    - `file_name` string, required
    - `base64_file` string
    - `mime_type` string, nullable
    - `url` string, nullable
  - `user_uuid` string, nullable
  - `config_name` string, required
  - `user_message` string, required
  - `incident_time` string, required
  - `incident_timezone` string, required
  - `services_context` ServiceContext[], required
    - `id` string, required
    - `name` string, required
    - `description` string, nullable
  - `relevant_context_ids` string[], nullable
  - `environment_context` EnvironmentContext
    - `name` string, required
  - `output_types` InvestigationOutputTypeEnum[], nullable
  - `trigger_type` 'manual' | 'auto-trigger' | 'slack_mention' | 'slack_dm' | 'slack_investigate_command' | 'slack_channel_join_auto_trigger' | 'slack_message_auto_trigger' | 'topology_explore' | 'alert_chat' | 'alert_event_manual_investigate' | 'alert_event_anomaly_detected_investigate' | 'proactive_followup' | 'alert_story' | 'alert_summary' | 'api' | 'mcp' | 'channel_agent' | 'deep_wiki' | 'autoresearch' | 'incident_monitor_postmortem'
  - `context_items` ContextItemInput[], nullable
    - `id` string, required
    - `organization_id` string, required
    - `context_item_name` 'central_id' | 'function' | 'application' | 'service' | 'team' | 'url_endpoint' | 'correlation_id' | 'topology_node' | 'account' | 'storage' | 'environment' | 'cluster' | 'snow_alert' | 'snow_incident' | 'snow_problem' | 'snow_change_request' | 'customer_journey' | 'domain' | 'mim_id' | 'monitor_id', required — Enum for context item names.
    - `value` string, required
    - `metadata` object, required
  - `parent_session_id` string, nullable
  - `mode` 'rca' | 'chat' | 'triage' | 'alert_story'
  - `thinking_mode` 'auto' | 'deep' | 'fast' | 'lightning' — Determines the investigation depth and approach. - AUTO: Use message classifier to determine RCA vs CHAT - DEEP: Force RCA (root cause analysis) investigation - FAST: Force CHAT (exploratory) investigation - LIGHTNING: Fast, tool-rich investigation with tight iteration cap. Uses the union of all tools from fast + deep configs with a speed-focused prompt.
  - `knowledge_version_id` string, nullable
  - `alert_params` AlertParams — Parameters for alert-based investigations.
    - `start_time` string, required
    - `end_time` string, required
    - `status` 'escalated' | 'anomalous' | 'dismissed' — Derived status for an alert event based on escalation and anomaly detection.
    - `search_query` string, nullable
  - `additional_instructions` string, nullable

## Response `200`

Successful Response

- InvestigationResponse
  - `session_id` string, required
  - `user_chat_id` string, required
  - `system_chat_id` string, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/traversal/apis/fastapi.md) · [All operations](https://skmtc.net/traversal/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/traversal/fastapi/revisions/2134ebffd1ef/schema)