Incidents

Open, investigate and resolve security incidents.

📄️List incidents

Newest first (created_at DESC, id DESC - stable under later edits, unlike updated_at). `status=open` is every status except

📄️Create incident

Create incident

📄️Get incident

Get incident

📄️Patch incident

Patch incident

📄️Add comment

Analyst note, stored verbatim as plain text (no markup interpretation, ‹= 4000 chars). The UI must render it escaped.

📄️Add incident link

Link evidence (finding / shadow candidate / agent / event / execution / policy decision / simulation run) that exists in THIS tenant,

📄️Transition incident

new -> investigating|resolved, investigating -> resolved, resolved -> closed|reopened, closed -> reopened,