Skip to main content
GET
/
v1
/
triage
/
{incidentId}
/
evidence
List evidence
curl --request GET \
  --url https://api.example.com/v1/triage/{incidentId}/evidence \
  --header 'Authorization: <authorization>'

​
Overview

Returns the full set of evidence items gathered by the triage pipeline for an incident. Evidence includes logs, metrics, deployment events, and code changes correlated with the incident window. Required role: admin or member

​
Request headers

​
Authorization
string
required
JWT Bearer token. Format: Bearer <your-jwt>.

​
Path parameters

​
incidentId
string
required
The unique identifier of the incident. Example: inc_EXAMPLE_01JX.

​
Query parameters

​
type
string
Filter by evidence type. One of: log, metric, deployment, code_change, alert, runbook.
​
limit
integer
Maximum number of items to return. Default: 50. Maximum: 200.
​
cursor
string
Pagination cursor from a previous response nextCursor field.

​
Response

Returns 200 OK with a paginated list of evidence items. 
{
  "items": [
    {
      "evidenceId": "evi_01HX9VTPQR3KF8MZWBYD5N6JCE",
      "type": "log",
      "source": "cloudwatch",
      "summary": "10,432 errors matching pattern 'connection refused' between 14:25–14:35 UTC",
      "severity": "critical",
      "timestamp": "2024-04-01T14:28:00Z",
      "rawSnippet": "FATAL: connection refused to payment-processor:5432 (timeout after 30s)"
    },
    {
      "evidenceId": "evi_01HX9VTPQR3KF8MZWBYD5N6JCF",
      "type": "deployment",
      "source": "github",
      "summary": "Deploy d9f3a21 pushed to production at 14:25 UTC — 3 minutes before incident",
      "severity": "high",
      "timestamp": "2024-04-01T14:25:00Z",
      "rawSnippet": "git push origin main @ d9f3a21 (checkout-service v2.4.1)"
    }
  ],
  "total": 14,
  "nextCursor": "eyJsYXN0SWQiOiJldmlfMDFIWDlWVFBRUjNLRjhNWldCWUQ1TjZKQ0YifQ"
}
FieldTypeDescription
evidenceIdstringUnique identifier for this evidence item
typestringEvidence category: log, metric, deployment, code_change, alert, runbook
sourcestringSystem that produced this evidence (e.g. cloudwatch, github, datadog)
summarystringAI-generated summary of the evidence item
severitystringRelevance rating: critical, high, medium, low, info
timestampstringISO 8601 timestamp of the evidence event
rawSnippetstringRaw excerpt from the source system

​
Error responses

StatusError codeDescription
401unauthorizedMissing or invalid JWT
403forbiddenCaller lacks required role
404incident_not_foundNo incident with the given ID
404triage_not_startedTriage has not yet run for this incident

​
Examples

curl "https://api.causeflow.ai/v1/triage/inc_EXAMPLE_01JX/evidence?type=deployment&limit=20" \
  -H "Authorization: Bearer eyJhbGc..."

Start triage

Trigger the triage pipeline for an incident

Add investigation context

Attach additional context to a running investigation