Skip to main content
Read everything that happened on an incident. The activity log is the full record: every status change, role handover, escalation, field edit and update, in the order they happened. Some of it gets promoted onto the incident’s timeline, which also carries items written by hand that never appear here. Use this to pull an incident’s history into your own systems - a retrospective, a report, an audit of how a response ran.

The incident activity log entry object

One thing that happened on an incident.

The activity log records everything. The timeline is the narrative, made of the entries someone promoted onto it and the items they wrote by hand.

created_at
string<date-time>
required

When we recorded the activity

Example:

"2026-09-01T15:30:01Z"

id
string
required

Unique identifier of the activity log entry

Example:

"01FCNDV6P870EA6S7TK1DSYDG0"

incident_id
string
required

ID of the incident this happened on. When the incident has streams, listing the parent also returns entries from its streams, and this is the stream's ID for those.

Example:

"01G0J1EXE7AXZ2C93K61WBPYEH"

occurred_at
string<date-time>
required

When the activity happened. This is what the log is ordered by.

Example:

"2026-09-01T15:30:00Z"

title
string
required

Human-readable summary of what happened

Example:

"Status changed from Investigating to Monitoring"

type
enum<string>
required

What kind of activity this is. Switch on this rather than title, which is display copy we reword.

Available options:
slack_pin,
microsoft_teams_pinned_channel_message,
summary_update,
role_update,
handover,
slack_infer_sentry,
slack_image,
microsoft_teams_image,
slack_message,
incident_channel_join,
incident_channel_leave,
incident_escalate,
action_created,
action_updated,
follow_up_created,
follow_up_updated,
actions_shared_in_channel,
follow_ups_shared_in_channel,
status_change,
atlassian_statuspage_update,
incident_update,
custom_field_value_update,
incident_membership_revoked,
incident_visibility_changed,
incident_rename,
incident_attachment_added,
incident_attachment_removed,
alert_attached_to_incident,
alert_group_attached_to_incident,
alert_group_detached_from_incident,
pagerduty_incident_triggered,
pagerduty_incident_acknowledged,
pagerduty_incident_resolved,
incident_timestamp_set,
incident_timestamp_occurred,
incident_merged,
incident_type_changed,
status_page_incident_linked,
status_page_incident_updated,
user_intent_declared,
call_url_changed,
postmortem_changed,
postmortem_document_v2_changed,
incident_channel_created,
scrub,
escalation_created,
escalation_acknowledged,
incident_call_created,
incident_call_started,
incident_call_ended,
incident_call_participants_updated,
microsoft_teams_message,
microsoft_teams_announcement_reply,
incident_call_transcript_message,
incident_call_transcript_summary_generated,
incident_call_transcript_key_moment_generated,
incident_call_transcript_current_topic_generated,
incident_call_recall_bot_status_changed,
scribe_added,
scribe_removed,
external_issue_comment_synced,
investigation_hypothesis_update,
workflow_ran
Example:

"incident_update"

content
object

Details of an activity log entry.

At most one key is set, and it matches the entry's type. Types not listed here carry no content: the entry's type and title are all there is.

Example: