The Major Incident Management plugin's API

All under /api/v1/x/major/, 404 while the plugin is off (it needs Incident Management on). Reading needs major:read, changing major:write, the settings major:admin (admins). Everything about an incident goes through Incident Management's access rules: an incident you can't see is 404 here too. Guide: major incidents.

Endpoint	What
GET ?status=open|done&orgId=&serviceId=	Major incidents you can see (on the service or one of its offerings, with serviceId), open first: commander, manager, next stakeholder update, escalation level, checklist progress.
GET reviews?state=open|overdue|completed&orgId=	Required post-incident reviews, overdue first (state: waiting, due, overdue, completed).
GET count	{ open, overdue } for the sidebar.
GET report?days=&orgId=	Declared (and by priority), time to declare and to resolve, escalated, checklist on time, stakeholder updates, reviews and actions, the overdue reviews.
GET staff	Active staff, to pick stakeholders from.
GET incidents/<id>	{ major, review, canEdit, devTasks }: the roles, bridge, stakeholders, rhythm, checklist (who checked what, when), stakeholder updates and escalation; the review with its owner, due date, state and actions. Nulls when the incident has neither.
POST incidents/<id>/declare	{ reason, managerId, commsLeadId, techLeadId, bridge }, all optional. 409 already_major. Role holders must see every affected unit (400 out_of_scope).
POST incidents/<id>/stand-down	{ reason }: no longer major; the incident stays.
PATCH incidents/<id>	managerId, commsLeadId, techLeadId (null removes), bridge, stakeholderIds (the whole list, any staff), updateEveryMinutes.
POST incidents/<id>/steps, PATCH …/steps/<stepId>, DELETE …/steps/<stepId>	Add a step { title, role }; check it off or undo { done }, rename { title }; remove it.
POST incidents/<id>/stakeholder-updates	{ body }: plain text up to 600 characters, emailed whole to the stakeholders.
PATCH incidents/<id>/review	ownerId, dueAt, completed (400 not_written until the incident's review is written).
POST incidents/<id>/review/actions, PATCH …/<actionId>, DELETE …/<actionId>	Actions: { title, ownerId, dueDate }; change them or { done }.
GET incidents/<id>/dev-projects, POST incidents/<id>/review/actions/<actionId>/dev-task	With Software Development on: the projects you can add tasks to; { projectId } makes the action a task there (tokens also need dev:write). The action is done when the task is.
GET settings/<orgId>, PATCH settings/<orgId>	Admins: autoPriorities, checklist ([{ title, minutes, role }]), noCommanderMinutes, noUpdateMinutes, repeatMinutes, levels ([{ userIds, unitIds }]), stakeholderIds, updateEveryMinutes, reviewPriorities, reviewDueDays, reviewTemplate.

Every minute the plugin:

• escalates open major incidents with no commander, or no update (a note, a customer update or a stakeholder update), for too long, one level further each repeatMinutes;
• reminds the communications lead when a stakeholder update is due;
• tells the owner once when a review is overdue.

It listens to incidents.declared and incidents.priority_changed (major by priority), incidents.resolved (the review becomes required) and incidents.deleted.

MCP tools

Scope	Tools
major:read	list_major_incidents, get_major_incident, list_reviews, major_report
major:write	declare_major_incident, stand_down_major_incident, update_major_incident, check_major_step, send_stakeholder_update, update_review, review_action (also makes dev tasks)
major:admin (admins)	get_major_settings

Webhook events

Event	With
major.declared	auto, reason.
major.stood_down
major.role_assigned	role, person.
major.escalated	level, reason (no_commander or no_update), notified.
major.stakeholder_update_sent	recipients.
major.review_required, major.review_overdue
major.review_completed	on_time.

Audited: declaring, standing down, completing a review, settings.