PATCH Assign an incident

/api/v1/alarms/incidents/{id}/assignment

Assign an active owner or editor using the current collaboration revision and an operation UUID. Send an empty assignee ID to clear the assignment.

On this page

Access and permissions

Assign an active owner or editor using the current collaboration revision and an operation UUID. Send an empty assignee ID to clear the assignment.

Browser session: __Host-mb_session cookie.

Machine management credentials in Authorization: Bearer. Check the permissions (scopes) required by the operation.

When using a browser session for a mutation, send the current CSRF token in X-CSRF-Token with the same-site cookie. OAuth consent uses its documented form field.

Parameters and headers

Field	Location	Type and limits	Required	Meaning
id	Path	string; {"format":"uuid"}	Yes	Resource UUID from the path. It must exist and be accessible to the acting identity.

Request body

Field	Type and limits	Required	Meaning
$	object	Yes	—
$.assignee_id	string	Yes	—
$.operation_id	string	Yes	—
$.revision	integer	Yes	—

Responses

Stable error codes
invalid_incident
invalid_assignee
invalid_input

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 422,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
unavailable

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Retry-After	string; {"pattern":"^[0-9]+$"}	Seconds before retry. Preserve supported idempotency identifiers and respect the operation’s mutation semantics.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 503,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
not_found

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 404,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
forbidden
insufficient_scope
invalid_origin
csrf

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 403,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
idempotency_conflict
revision_conflict
invalid_incident

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 422,
  "title": "Demo error",
  "type": "about:blank"
}

application/json

Field	Type and limits	Required	Meaning
$	object	Yes	—

This change does not have a general retry guarantee. If the response is unclear, read the affected resource before trying again. Follow Retry-After waiting times and request new sign-in or action codes when they expire.

Request examples

Replace demo IDs, timestamps and placeholders with your own values. For a retry, keep the same IDs, time and content. These examples do not run requests on this page.

Keep login links, codes, cookies and keys private. Do not print them in logs or share them in support requests.

curl --request PATCH --cookie '__Host-mb_session=SESSION; __Host-mb_csrf=CSRF' --header 'X-CSRF-Token: CSRF' --header 'Content-Type: application/json' --data '{"assignee_id":"","revision":1,"operation_id":"33333333-3333-4333-8333-333333333333"}' 'https://metribeacon.com/api/v1/alarms/incidents/11111111-1111-4111-8111-111111111111/assignment'

import requests
response=requests.request('PATCH','https://metribeacon.com/api/v1/alarms/incidents/11111111-1111-4111-8111-111111111111/assignment',cookies={"__Host-mb_session":"SESSION","__Host-mb_csrf":"CSRF"},headers={"X-CSRF-Token":"CSRF"},json={'assignee_id': '', 'revision': 1, 'operation_id': '33333333-3333-4333-8333-333333333333'})
response.raise_for_status()

const response=await fetch("https://metribeacon.com/api/v1/alarms/incidents/11111111-1111-4111-8111-111111111111/assignment",{method:"PATCH",credentials:"same-origin",headers:{"Content-Type":"application/json","X-CSRF-Token":csrf},body:JSON.stringify({"assignee_id":"","revision":1,"operation_id":"33333333-3333-4333-8333-333333333333"})});
if(!response.ok)throw new Error(String(response.status));

package main
import("net/http";"strings";"time")
func main(){req,err:=http.NewRequest("PATCH","https://metribeacon.com/api/v1/alarms/incidents/11111111-1111-4111-8111-111111111111/assignment",strings.NewReader(`{"assignee_id":"","revision":1,"operation_id":"33333333-3333-4333-8333-333333333333"}`));if err!=nil{panic("request failed")};req.AddCookie(&http.Cookie{Name:"__Host-mb_session",Value:"SESSION"});req.AddCookie(&http.Cookie{Name:"__Host-mb_csrf",Value:"CSRF"});req.Header.Set("X-CSRF-Token","CSRF");req.Header.Set("Content-Type","application/json");c:=http.Client{Timeout:10*time.Second};res,err:=c.Do(req);if err!=nil{panic("request failed")};defer res.Body.Close()}

HTTP API, OAuth and MCP
Find the user API endpoints, their permissions, fields, examples and response formats.
POST Acknowledge your incident
Acknowledge your incident.
GET Read channel-specific delivery attempts for an incident
Read channel-specific delivery attempts for an incident.
GET Read incident evaluation evidence
Returns the actual bounded trigger and recovery evaluation snapshots and recorded delivery suppression reasons. Existing incidents without snapshots return null; retained measurement history must not be treated as proof of the original evaluation. Current recovery progress is available only for the same still-active incident and unchanged rule version. Requires telemetry:read and access to the incident workspace.

Access and permissions

Parameters and headers

Request body

Responses

Retries and asynchronous work

Request examples

Related guides