Using the incident.io CLI

inc is the official command-line interface for the incident.io API. Use it to list and manage incidents, page people, inspect schedules, and script against your incident data without leaving the terminal. It’s built for both humans and LLM agents: every command supports JSON output, and the full command schema is machine-discoverable. The CLI is open source at github.com/incident-io/inc. Note that we recommend the MCP as the primary integration tool.

Install

# Homebrew
brew install incident-io/tap/inc

# mise
mise use -g ubi:incident-io/inc

Or download a binary for your platform from GitHub Releases.

Authenticate

inc auth login

This opens incident.io in your browser to authorize the CLI. The CLI then acts as you. It can see and do what your user can, and every action is attributed to you. Logins last 28 days. When yours expires, run inc auth login again.

Browser login uses the same organisation setting as the remote MCP server. An admin can enable it from Settings → MCP. If it’s disabled, use an API key instead.

For scripts and CI, use an API key instead. Create one in Settings → API keys, then either export it or save it to the CLI’s config:

# Option 1: environment variable
export INCIDENT_API_KEY=inc_abc123...

# Option 2: save to config
inc auth login --paste

An INCIDENT_API_KEY in the environment takes precedence over a saved login. Verify whichever you set up:

inc auth status

The CLI can only do what your user or API key allows. For scripts, scope keys to what they need. Read-only keys are a good default for reporting and exploration.

Everyday commands

# What's live right now
inc incidents list --status-category live

# Create an incident
inc incidents create --name "Database outage" --visibility public --severity-id 01ABC...

# Page someone
inc escalations create --title "Database latency spike" --escalation-path-id 01ABC...

# Who's on call for a schedule
inc schedules entries 01ABC... --from 2026-07-20T00:00:00Z --until 2026-07-21T00:00:00Z

# Pull a post-mortem as markdown
inc post-mortems content 01ABC... > postmortem.md

Run inc --help for the full command list, covering incidents, alerts, catalog, escalations, schedules, severities, users, roles, custom fields, post-mortems, and follow-ups.

Scripting and JSON output

When you pipe output, the CLI automatically switches to JSON. Use the built-in --jq flag to filter responses without installing anything else:

# Closed incidents this month, counted by severity
inc incidents list --status-category closed --jq 'group_by(.severity.name) | map({severity: .[0].severity.name, count: length})'

# Just the fields you need
inc incidents list --fields id,name,reference --output json

Errors are structured JSON too, with a retryable field to gate retries on and a request_id you can share with our support team. Rate-limited requests retry automatically.

Call any endpoint

If a dedicated command doesn’t exist yet, inc api can call any endpoint in the API reference with authentication pre-configured:

inc api GET /v2/incidents --field 'status_category[one_of]=live' --jq '.incidents[].name'
inc api GET /v2/alerts --paginate --jq '.alerts[].title'

For LLM agents

The CLI supports agent use as well. inc describe outputs a JSON schema of every command and flag, and --dry-run previews any request without sending it:

inc describe incidents.create
inc incidents create --name "Test" --visibility public --dry-run

See AGENTS.md in the repository for detailed agent integration guidance.

Getting started

Alerts

On-call

Incident response

Post-incident

Status pages

Nexus

Investigations

AI features

Catalog

Workflows

Insights

Integrations

Administration

Need more help?

Using the incident.io CLI

Install

Authenticate

Everyday commands

Scripting and JSON output

Call any endpoint

For LLM agents

​Install

​Authenticate

​Everyday commands

​Scripting and JSON output

​Call any endpoint

​For LLM agents

Install

Authenticate

Everyday commands

Scripting and JSON output

Call any endpoint

For LLM agents