Permissions and the API

Who may do what

Each step needs a permission, held everywhere or in one of the incident's units:

To	Permission	Held by
See incidents	incident.read	Agent, Viewer, Auditor, Incident Manager, Incident Responder
Declare and work on them: status, commander, category, units, notes, linked cases, the review	incident.write	Agent, Incident Manager, Incident Responder
Send updates to requesters	incident.send_update	Incident Manager, Incident Responder
Change priority, impact or urgency	incident.change_priority	Incident Manager
Delete an incident	incident.delete	Incident Manager
Settings → Incident Management (the matrix, targets, resolution codes, causes, categories)	incident.settings	Incident Manager

Administrators hold them all. Give them to your own roles under Roles.

For AI assistants and the API

With the plugin on, tokens can get incidents:read, incidents:write and incidents:admin (Settings → API tokens). AI assistants get tools to list, read, declare and update incidents (status, holds, resolving, priority, category, whether it is public), link cases, send updates, write the review, get the numbers and the categories and codes, and (admins) change the settings. The API is described in building a plugin.