Documentation

The REST API

Everything the console does is an HTTP call, and the API is documented from the same source the console and the apps use. This page is the orientation: which credential goes where, the conventions, and where the full reference lives.

The three credentials

Every request carries one Authorization header, and its prefix says which credential it is. A key behind the wrong prefix is a 403 invalid_token; a request without the header is a 401.

Credential	Header	Acts as	Where it comes from
Session token	Authorization: Bearer <id token>	The signed-in person. What the console and the apps send.	Signing in.
Personal API key	Authorization: PAT <key>	Its owner, on every organization route. Never on the account’s own settings, notification methods, devices or keys.	Account → API keys. Expires after 1 to 3,650 days, or never.
Integration key	Authorization: ign_…	A monitoring tool. It can only POST alerts to its team.	The team’s Integration keys tab. Expires after 1 day to a year, or never. Revoke or reissue at any time.

URLs, ids and dates

The base is https://api.igniteops.io/v1. Organization and team resources live under /organizations/{organizationName}/incident-management/{teamName}/…, by name, as they appear in the console’s address bar. Names are letters, digits, hyphens and underscores.
Ids are UUIDs. Timestamps are RFC 3339 in UTC with milliseconds, like 2026-11-08T03:07:11.412Z.
Request and response bodies are JSON. Text fields have the limits the console shows, and long text in an alert is clipped rather than refused.
List endpoints take limit and return next_token when there is more. The alerts list also filters by status, severity, assignee, source, tags, created_after and created_before, and sorts with sort_by and sort_order.

List the open P1 and P2 alerts of a teamcurl

curl -sS "https://api.igniteops.io/v1/organizations/acme/incident-management/platform/alerts?status=open&severity=P1,P2&limit=50" \
  -H "Authorization: PAT <your personal API key>"

Errors and retries

An error is a JSON object with a machine-readable error and a sentence in error_description. Validation errors name what was wrong.

400JSON

HTTP/1.1 400 Bad Request
{
  "error": "validation_error",
  "error_description": "Rotation 1: participant 2 is not a member of this team",
  "status": 400
}

Status	Meaning	What to do
400 validation_error	A field is missing or malformed. The description says which.	Fix the request.
401	No credential.	Send the Authorization header.
402 plan_limit_reached / plan_feature_required	The Free plan’s cap or a Pro feature.	Upgrade, or stay within the cap.
403 invalid_token / forbidden / forbidden_for_role	The credential is wrong for this route, or the role does not allow it.	Check the prefix and the role.
409	A conflict: an overlapping override, a name already in use.	Read the description.
429	A throttled request: the Free plan’s ingest rate, or a per-organization rate such as test deliveries.	Wait for the Retry-After header (the body’s retry_after says the same).
503 service_unavailable	The request could not be authorized or confirmed right now. Nothing was done.	Retry after the Retry-After header (5 to 30 seconds).

During a service disruption, alerts sent with an integration key are still accepted and paged (the answer carries degraded: true), while changes to existing alerts answer 503 until the service recovers. Outbound webhooks carry an Idempotency-Key so your receiver can drop a repeated delivery.

What the API covers

Area	Resources
Alerts	Create (webhook or person), list and filter, read, update, acknowledge, close, reopen, delete, comments, activity timeline.
Teams	Teams and their members, with team roles.
Routing rules	Create, list, read, update, delete, in priority order.
Escalation policies	Create, list, read, update, delete, with steps and repeat.
Schedules	Create, list, read, update, delete, overrides, who-is-on-call at any instant, the .ics export.
Integration keys	Create, list, revoke, reissue.
Metrics	Per organization and per team: counts, MTTA, MTTR, by severity, by source.
Organizations	Create, read, update, members, invitations, ownership transfer, deletion.
Billing	Plan, seats, payment methods, usage, invoices (the owner).
Account	Profile, notification methods, push devices, personal API keys, preferences, deletion and restore.
AI insights	Insights and the weekly review (Pro), dismiss.

The reference and the OpenAPI document

The full reference, with every endpoint, parameter, schema and example, is at igniteops.io/api-reference. It is rendered from api.igniteops.io/openapi.json, the OpenAPI 3 document the API is deployed from, so it cannot drift from what the servers accept. Download it to generate a client or to import into your API tool.

Idempotent writes: creating an alert with the same alias twice updates one alert. Updates to an alert take expected_updated_at so two writers do not overwrite each other. Schedule and policy updates keep a rotation’s or a step’s id when you send it back.

Checked against the product on November 8, 2026.