Resolve REST API

query resolve investigations from scripts, dashboards, or any http client if you're connecting a coding agent (claude code, codex, cursor) or another mcp client, use ai assistant plugins docid\ bcqpoqdctungseqk8q5m instead authentication all requests require a bearer token recommended a personal token from user menu > api tokens personal tokens attribute all actions to your user identity for shared service integrations or scripts that run on behalf of the organization, use an organization token from admin > api tokens instead include the token in all requests authorization bearer \<your token> trigger an investigation post /api/v1/investigations base url https //app0 resolve ai requires a personal token ( user menu > api tokens ) organization tokens cannot trigger investigations ( 401 ), because every investigation is attributed to a real user body exactly one of the following field type description source string free form text describing the problem (e g built from a servicenow incident short description plus context) alertid string the alert id of an alert resolve already ingested (from the list investigations docid 84w41k1clcddxcqw3tihd endpoint) example (free form text) curl ss x post "https //app0 resolve ai/api/v1/investigations" \\ h "authorization bearer $token" \\ h "content type application/json" \\ d '{"source" "inc12345678 checkout p99 latency spiked to 4s starting 14 32 utc, only us east 1, correlated with the deploy of svc checkout 1 42 0"}' example (existing alert) curl ss x post "https //app0 resolve ai/api/v1/investigations" \\ h "authorization bearer $token" \\ h "content type application/json" \\ d '{"alertid" "alert 123"}' response returns 202 accepted immediately; the investigation continues in the background poll get investigation details docid 84w41k1clcddxcqw3tihd until iscomplete is true , then read the markdown report from the reports array canvasurl is the link to paste into the servicenow work notes { "canvasid" "01knw9eydmcj35a9f2pd630zyg", "canvasurl" "https //app0 resolve ai/canvas/01knw9eydmcj35a9f2pd630zyg" } errors status cause 400 the body does not contain exactly one of source or alertid , or the referenced event is not an alert 401 the request used an organization token instead of a personal token 404 the alertid was not found in your organization to find the alert id for an incident, if the alert carries the inc number as a label, look it up first with list investigations docid 84w41k1clcddxcqw3tihd , then trigger by id curl ss h "authorization bearer $token" \\ "https //app0 resolve ai/api/v1/investigations?starttime=2026 07 01t00 09 59z\&label number=inc12345678" list investigations get /api/v1/investigations base url https //app0 resolve ai query parameters parameter type description starttime iso datetime start of search window (default 1 hour ago) endtime iso datetime end of search window (default now) cursor string pagination cursor from a previous response label string filter by alert labels (e g label service name=checkout api ) multiple label filters use and logic all specified labels must match example curl h "authorization bearer $token" \\ "https //app0 resolve ai/api/v1/investigations?label service name=checkout api\&label severity=critical" response { "investigations" \[ { "canvasid" "01knw9eydmcj35a9f2pd630zyg", "name" "high error rate on checkout api", "alert" { "id" "alert 123", "name" "checkout error rate > 5%", "labels" { "service name" "checkout api", "severity" "critical" } }, "createdat" "2025 03 01t10 00 00 000z" } ], "nextcursor" null } get investigation details get /api/v1/investigations/\ canvasid returns the full investigation including status, completion state, and report files (problem summary, status updates, theories) example curl h "authorization bearer $token" \\ "https //app0 resolve ai/api/v1/investigations/01knw9eydmcj35a9f2pd630zyg" response { "canvasid" "01knw9eydmcj35a9f2pd630zyg", "name" "high error rate on checkout api", "status" "stopped", "iscomplete" true, "reports" \[ { "filepath" "/problem md", "versions" \[ { "versionid" 0, "createdat" "2025 03 01t10 05 00 000z", "content" "# problem\n " } ] }, { "filepath" "/status update md", "versions" \[ ] } ] }