Skip to content
Vendorica Developer Docs

File an incident

POST
/incidents
curl --request POST \
  --url https://api.vendorica.com/v1/incidents \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "title": "example", "description": "example", "priority": "low", "vendorId": "", "assignedTo": "", "dueDate": "", "businessImpact": "None", "affectedCustomers": "", "reportedAt": "2026-04-15T12:00:00Z", "category": "example", "incidentType": "example", "affectedSystems": "", "affectedServices": "", "impactAssessment": "", "escalationLevel": 1, "estimatedFinancialImpact": 1, "idempotencyKey": "example" }'

Creates an ICT incident in the calling key’s organization. reportedAt is the moment the ENTITY BECAME AWARE of the incident, and every DORA Art. 19 deadline is computed from it — initial notification at min(classifiedAt + 4h, reportedAt + 24h), intermediate at +72h, final at +1 month. Send it. Omitted, it defaults to the moment this row is written, so a relay that batches, a queue that backs up, or a replay of yesterday’s alerts each move a supervisory deadline against a four-hour window. ISO 8601 with an offset; a value in the future is refused with 422.

Idempotent on the optional idempotencyKey: a second submission carrying a key an earlier one used returns THAT incident with 200 and Idempotent-Replay: true, and files nothing — no duplicate row, no audit entry, no incident.created event. A first submission answers 201 with Idempotent-Replay: false. Omitting the key is legal and is never deduplicated.

The body is strict: an unrecognised field is a 422 naming it, never a silent no-op. status is refused by name — transitions are a state machine with their own endpoints.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
title
required
string
>= 1 characters <= 255 characters
description
string
priority
string
default: medium
Allowed values: low medium high critical
vendorId
Any of:
string format: uuid
assignedTo
Any of:
string format: uuid
dueDate
Any of:
string format: date
businessImpact
string
Allowed values: None Low Medium High Critical
affectedCustomers
Any of:
integer
reportedAt
string format: date-time
category
string
>= 1 characters <= 50 characters
incidentType
string
>= 1 characters <= 50 characters
affectedSystems
Any of:
string
<= 2000 characters
affectedServices
Any of:
string
<= 2000 characters
impactAssessment
Any of:
string
<= 5000 characters
escalationLevel
integer
>= 1 <= 5
estimatedFinancialImpact
Any of:
number
idempotencyKey
string
>= 8 characters <= 64 characters

Responses

Section titled “Responses”

201

Section titled “201”

Success

Media typeapplication/json
object
success
required
boolean
data
required
object
id
required
string format: uuid
organizationId
required
string format: uuid
title
required
string
description
required
string | null
status
required
string
priority
required
string | null
category
required
string | null
incidentType
required
string | null
reportedAt
required
string | null format: date-time
createdAt
required
string | null format: date-time
updatedAt
required
string | null format: date-time
resolvedAt
required
string | null format: date-time
closedAt
required
string | null format: date-time
dueDate
required
string | null
vendorId
required
string | null format: uuid
assignedTo
required
string | null format: uuid
reportedBy
required
string format: uuid
businessImpact
required
string | null
affectedCustomers
required
integer | null
affectedSystems
required
string | null
affectedServices
required
string | null
impactAssessment
required
string | null
escalationLevel
required
integer | null
estimatedFinancialImpact
required
string | null
idempotencyKey
required
string | null
key
additional properties
timestamp
required
string format: date-time
requestId
string
message
string
Example
{
  "success": true,
  "data": {
    "id": "55d0e4df-f4d8-47e7-8479-2bece2c01e38",
    "organizationId": "d5ad156e-cb78-4904-860b-460574bf3393",
    "title": "string",
    "description": "string",
    "status": "string",
    "priority": "string",
    "category": "string",
    "incidentType": "string",
    "reportedAt": "2026-08-19T09:41:12.004Z",
    "createdAt": "2026-08-19T09:41:12.004Z",
    "updatedAt": "2026-08-19T09:41:12.004Z",
    "resolvedAt": "2026-08-19T09:41:12.004Z",
    "closedAt": "2026-08-19T09:41:12.004Z",
    "dueDate": "string",
    "vendorId": "9d3b4b61-e757-4cd9-8905-1b2e5d09c31e",
    "assignedTo": "067ed2bb-f2a5-493b-82e2-932846adae44",
    "reportedBy": "d80fa382-a09e-4280-8c55-143996eedc07",
    "businessImpact": "string",
    "affectedCustomers": 1,
    "affectedSystems": "string",
    "affectedServices": "string",
    "impactAssessment": "string",
    "escalationLevel": 1,
    "estimatedFinancialImpact": "string",
    "idempotencyKey": "string"
  },
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H",
  "message": "string"
}

400

Section titled “400”

Validation error

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Bad request",
  "code": "BAD_REQUEST",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

401

Section titled “401”

Unauthorized

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Unauthorized",
  "code": "UNAUTHORIZED",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

403

Section titled “403”

Forbidden — missing scope

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Forbidden",
  "code": "FORBIDDEN",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

404

Section titled “404”

Not found

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Resource not found",
  "code": "NOT_FOUND",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

409

Section titled “409”

The API key has no resolvable owner, so the incident cannot name a user (API_CLIENT_OWNER_UNRESOLVED). Re-issue the key with an owner.

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false
}

422

Section titled “422”

Unrecognised or invalid field — the response names it

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Validation failed",
  "code": "VALIDATION_ERROR",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

429

Section titled “429”

Rate limit exceeded

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Too many requests",
  "code": "TOO_MANY_REQUESTS",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}