Skip to main content

API - incidents and alerting

All paths are relative to https://api.wakora.io/v1/; see the overview for tokens, scopes and errors.

Incidents​

MethodEndpointScopeWhat it does
GET/incidents?state=&severity=&server=&rule=&from=&to=&limit=&offset=readIncident list. state is open, acked or resolved; limit caps at 200.
GET/incidents/{num}readOne incident with its full timeline and the runbooks that apply to it. Numbers are the per-workspace ones the console shows.
POST/incidents/{num}/ackactAcknowledge. Attributed to the token's owner, or to "AI" for an MCP token.
POST/incidents/{num}/resolveactResolve. Resolving a host that is still down is turned into an acknowledgement, and the answer says so; the recovery resolves it.
POST/incidents/{num}/jiraactCreate a Jira issue for the incident (Jira must be connected in Integrations). Repeated calls answer the existing issue key.

An incident row looks like:

{
  "num": 42, "title": "disk almost full", "rule": "disk_critical",
  "severity": "critical", "state": "open",
  "entity": "/var", "server": "b62a...", "hostname": "web-1",
  "value": 96.2, "threshold": 95,
  "startedAt": "2026-08-13T21:04:11Z", "ackedAt": null,
  "resolvedAt": null, "lastEventAt": "2026-08-13T21:04:11Z"
}

Resolving an incident whose condition still holds is honoured for the moment and reopened within minutes if the condition is still there; the timeline shows both. Use a maintenance window when you want quiet rather than a closed incident.

Runbooks​

MethodEndpointScopeWhat it does
GET/runbooksreadEvery runbook of the workspace: rule, scope (all, tag, host), value, pattern, title, url, content.
POST/runbooksactCreate one with the same fields. value is the tag name for a tag scope, the host uuid for a host scope.
POST/runbooks/{id}actUpdate; fields you leave out keep their value.
DELETE/runbooks/{id}actDelete.

Writes also need the runbooks capability of the token owner's role; a workspace token without a person behind it needs the admin scope. Runbooks are a Pro feature, so on a lower plan the routes answer 403. How a runbook is matched to an incident is in Runbooks.

Alert rules​

MethodEndpointScopeWhat it does
GET/rules?server=readThe rule catalog with armed verdicts and your overrides. server scopes the verdicts to one host and includes its per-host rows.
POST/rulesadminSave an override or a custom rule: ruleKey (omit to mint a custom one), name, metric, tagKey, op (gte, lte, eq), threshold, disarm, forSec, severity, enabled, and pattern for a log-pattern rule.
DELETE/rules/{ruleKey}adminReset an override back to the catalog default.

An override tunes a rule, it does not redefine it: the metric an event-born rule watches, and whether a rule is auto-armed, come from the catalog even after an override. Metric names and the wildcard syntax are in the metrics reference; every built-in rule with its defaults is in the rules catalog.

Maintenance windows​

MethodEndpointScopeWhat it does
GET/maintenancereadActive and scheduled windows.
POST/maintenanceactSchedule a window: name, optional server (omit for the whole workspace), start (default now), durationSec (default 7200), repeat (daily or weekly, omit for one-off).
DELETE/maintenance/{id}actEnd or cancel a window.

A deployment pipeline typically opens a two-hour window on the hosts it touches right before the rollout and deletes it right after:

curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  "https://api.wakora.io/v1/maintenance?name=deploy+2026-09-05&server=$UUID&durationSec=1800"

Cron heartbeats​

MethodEndpointScopeWhat it does
GET/heartbeatsreadHeartbeat jobs with their ping URLs, severity and last ping time.
POST/heartbeatsactCreate a job: name, intervalSec (60 or more), optional severity (warning, the default, or critical). The grace period is a quarter of the interval, at least a minute. The answer carries the pingUrl to put in the crontab.
DELETE/heartbeats/{id}actDelete a job.
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  "https://api.wakora.io/v1/heartbeats?name=nightly-backup&intervalSec=86400"
# {"ok":1,"id":7,"pingUrl":"https://app.wakora.io/?hb=hb_..."}

The ping itself is a plain GET to the pingUrl and needs no token; see Cron heartbeats.