Incident Timeline Items

Read and write the items on an incident’s timeline. The timeline is the curated narrative of an incident: the handful of moments that explain what happened, rather than the activity log, which records everything that did. Items are either promoted or custom. Promoted items are activity lifted onto the timeline - a pinned message, an escalation, an incident update, an event added by a workflow - and carry the ID of the activity log entry they came from. Custom items are written by hand, in the dashboard or through this API, and have no activity_log_id. Use this to pull an incident’s narrative into your own systems - a retrospective template, a report, a record you keep outside incident.io - and to put the things you know about back on it, like a deploy, a config change or a load test you halted.

The incident timeline item object

An item on an incident's curated timeline.

The timeline is the narrative of an incident, as opposed to the activity log, which records everything that happened. Some of that activity - a pinned message, an escalation, an event a workflow added - is promoted onto the timeline, and those items carry the ID of the activity log entry they came from. The rest are custom, written by hand in the dashboard or through the API, and have no activity_log_id.

created_at

string<date-time>

required

When this item was added to the timeline

Example:

"2026-09-01T15:31:04Z"

creator

object

required

Show child attributes

Example:

{
  "alert": {
    "id": "01GW2G3V0S59R238FAHPDS1R66",
    "title": "*errors.withMessage: PG::Error failed to connect"
  },
  "api_key": {
    "id": "01FCNDV6P870EA6S7TK1DSYDG0",
    "name": "My test API key"
  },
  "user": {
    "email": "lisa@incident.io",
    "id": "01FCNDV6P870EA6S7TK1DSYDG0",
    "name": "Lisa Karlin Curtis",
    "role": "owner",
    "slack_user_id": "U02AYNF2XJM"
  },
  "workflow": {
    "id": "01FCNDV6P870EA6S7TK1DSYDG0",
    "name": "My little workflow"
  }
}

string

required

Unique identifier of the timeline item

Example:

"01FCNDV6P870EA6S7TK1DSYDG0"

incident_id

string

required

ID of the incident this item belongs to. When the incident has streams, listing the parent also returns items belonging to its streams, and this is the stream's ID for those.

Example:

"01G0J1EXE7AXZ2C93K61WBPYEH"

timestamp

string<date-time>

required

When the thing this item describes happened. This is what the timeline is ordered by, and is not the same as created_at.

Example:

"2026-09-01T15:30:00Z"

title

string

required

Title of the timeline item

Example:

"Rolled back payments-api"

updated_at

string<date-time>

required

When this item was last edited

Example:

"2026-09-01T16:45:00Z"

activity_log_id

string

ID of the activity log entry this item was promoted from. Null for items written by hand, which are the items whose timestamp can be changed.

Example:

"01FCNDV6P870EA6S7TK1DSYDG1"

description

string

Description of the timeline item, in markdown. Absent when the item has no description.

Example:

"Rolled back **payments-api** to v411 after error rate hit 12%."

Getting started

Webhooks

Audit logs

Deprecated endpoints

Incident Timeline Items

The incident timeline item object

​The incident timeline item object

The incident timeline item object