name: datadog-incidents description: Work with Datadog Incidents API - fetch incidents with enrichment, update incident fields, understand incident data structures. Use when working with incidents or the dd get-incident/update-incident commands.

Datadog Incidents API

CLI Commands

# Get incident by ID (public ID like 152, or UUID)
dd get-incident 152

# Get enriched incident with user details
dd get-incident 152 --include users

# Get fully enriched with incident type and integrations
dd get-incident 152 --include users --enrich

# Update incident
dd update-incident 152 --title "New Title" --severity SEV-2 --state resolved

Enrichment Levels

Basic (no flags)

Returns incident data with UUIDs for users - less useful for human analysis.

With --include users

Transforms user references:

"created_by": {
  "data": {
    "type": "users",
    "id": "0082a465-...",
    "attributes": {
      "name": "Peter Chang",
      "email": "peterc@wonder.com"
    }
  }
}

With --enrich

Adds enrichment section with:

• Incident type: Name, description, prefix
• Integrations: Slack channels, Jira tickets with direct links

Update Fields

Standard fields

• --title - Incident title
• --severity - SEV-1, SEV-2, etc.
• --state - active, stable, resolved
• --customer-impacted - true/false
• --customer-impact-scope - Description of impact

Custom fields

dd update-incident 152 --field "root_cause=Database timeout" --field "teams=backend"

Key Notes

• CLI accepts public IDs: Use 152 instead of full UUID
• API requires UUIDs: CLI handles conversion internally
• Permission requirements: App key owner needs incident management permissions
• The include parameter only works for users and attachments

curl Examples

# Get with user enrichment
curl -X GET "https://api.$DD_SITE/api/v2/incidents/$INCIDENT_UUID?include=users" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY"

# Get integrations (Slack/Jira)
curl -X GET "https://api.$DD_SITE/api/v2/incidents/$INCIDENT_UUID/relationships/integrations" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY"

# Get incident type config
curl -X GET "https://api.$DD_SITE/api/v2/incidents/config/types/$TYPE_UUID" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY"