Incident and maintenance endpoints

Read incidents and windows publicly; create and manage them with a token.

Reads are public; every mutation lives behind /admin/*. Both groups return 404 { "error": "This feature is disabled." } when their feature is off.

`GET /incidents`

bash

curl "https://status.acme.com/api/heyo-status/incidents?status=investigating,identified&limit=10"

Query	Type	Notes
`status`	`investigating`, `identified`, `monitoring`, `resolved`	comma-separated
`severity`	`minor`, `major`, `critical`	comma-separated
`from`	ISO-8601	inclusive lower bound
`to`	ISO-8601	inclusive upper bound
`limit`	non-negative integer
`offset`	non-negative integer

json

[  {    "id": "inc_2f8c1d",    "title": "Elevated API latency",    "status": "monitoring",    "severity": "major",    "affectedMonitors": ["API"],    "auto": false,    "createdAt": "2026-01-01T10:02:00.000Z",    "updatedAt": "2026-01-01T10:41:00.000Z",    "resolvedAt": null,    "updates": [      {        "id": "upd_91ab3c",        "status": "investigating",        "message": "We are investigating elevated response times.",        "createdAt": "2026-01-01T10:02:00.000Z"      },      {        "id": "upd_a04f7d",        "status": "monitoring",        "message": "A fix is deployed; watching latency.",        "createdAt": "2026-01-01T10:41:00.000Z"      }    ]  }]

`GET /incidents/:id`

One incident with its timeline, or 404 { "error": "Incident not found." }.

`POST /admin/incidents`

bash

curl -X POST https://status.acme.com/api/heyo-status/admin/incidents \  -H "authorization: Bearer $HEYO_STATUS_API_TOKEN" \  -H "content-type: application/json" \  -d '{    "title": "Elevated API latency",    "severity": "major",    "affectedMonitors": ["API"],    "message": "We are investigating elevated response times.",    "status": "investigating"  }'

titlestringrequired

Non-empty; trimmed.

severity"minor" | "major" | "critical"required

affectedMonitorsstring[]required

Trimmed and de-duplicated. An empty array means global.

messagestringrequired

The first timeline entry.

status"investigating" | "identified" | "monitoring"optional

Defaults to investigating. Creating one as resolved is rejected.

Returns 201 with the created incident and dispatches incident.created.

`POST /admin/incidents/:id/updates`

Append a timeline entry — the normal way to progress an incident.

bash

curl -X POST https://status.acme.com/api/heyo-status/admin/incidents/inc_2f8c1d/updates \  -H "authorization: Bearer $HEYO_STATUS_API_TOKEN" \  -H "content-type: application/json" \  -d '{"status":"resolved","message":"Latency is back to normal."}'

Field	Required	Notes
`status`	yes	Any incident status, including `resolved`.
`message`	yes	Timeline text.
`severity`	no	Changes severity with this entry.

Dispatches incident.resolved for resolved, otherwise incident.updated.

`PATCH /admin/incidents/:id`

Edit fields without writing a narrative update. Omitted fields keep their current value, and message defaults to "Incident details updated.".

bash

curl -X PATCH https://status.acme.com/api/heyo-status/admin/incidents/inc_2f8c1d \  -H "authorization: Bearer $HEYO_STATUS_API_TOKEN" \  -H "content-type: application/json" \  -d '{"severity":"critical"}'

`DELETE /admin/incidents/:id`

204 on success, 404 if unknown. Deletion removes the incident and its timeline; it does not emit an event. Prefer resolving — a deleted incident disappears from the public history and from the feeds.

`GET /maintenance`

Upcoming and in-progress windows. Completed ones are never published.

bash

curl https://status.acme.com/api/heyo-status/maintenance

json

[  {    "id": "mnt_71be90",    "title": "Database upgrade",    "description": "Read-only for about 30 minutes.",    "affectedMonitors": ["API", "Dashboard"],    "scheduledStart": "2026-02-01T02:00:00.000Z",    "scheduledEnd": "2026-02-01T03:00:00.000Z",    "status": "scheduled",    "createdAt": "2026-01-20T09:14:00.000Z"  }]

status is derived from the clock each time the list is read.

`POST /admin/maintenance`

bash

curl -X POST https://status.acme.com/api/heyo-status/admin/maintenance \  -H "authorization: Bearer $HEYO_STATUS_API_TOKEN" \  -H "content-type: application/json" \  -d '{    "title": "Database upgrade",    "description": "Read-only for about 30 minutes.",    "affectedMonitors": ["API"],    "scheduledStart": "2026-02-01T02:00:00Z",    "scheduledEnd": "2026-02-01T03:00:00Z"  }'

titlestringrequired

descriptionstringoptional

affectedMonitorsstring[]required

Empty means every monitor.

scheduledStartISO-8601required

scheduledEndISO-8601required

Must be after scheduledStart.

Returns 201 and dispatches maintenance.scheduled, maintenance.starting or maintenance.completed depending on the derived status.

`PATCH /admin/maintenance/:id`

Any subset of title, description, affectedMonitors, scheduledStart, scheduledEnd and status. An empty body is rejected with 400 { "error": "At least one field must be provided." }.

bash

curl -X PATCH https://status.acme.com/api/heyo-status/admin/maintenance/mnt_71be90 \  -H "authorization: Bearer $HEYO_STATUS_API_TOKEN" \  -H "content-type: application/json" \  -d '{"status":"completed"}'

`DELETE /admin/maintenance/:id`

204 on success, 404 if unknown.

Every mutation invalidates the snapshot

The cached snapshot is dropped on each write, so the page and the API agree immediately rather than after the TTL.

GET /incidents

GET /incidents/:id

POST /admin/incidents

POST /admin/incidents/:id/updates

PATCH /admin/incidents/:id

DELETE /admin/incidents/:id

GET /maintenance

POST /admin/maintenance

PATCH /admin/maintenance/:id

DELETE /admin/maintenance/:id

Related

`GET /incidents`

`GET /incidents/:id`

`POST /admin/incidents`

`POST /admin/incidents/:id/updates`

`PATCH /admin/incidents/:id`

`DELETE /admin/incidents/:id`

`GET /maintenance`

`POST /admin/maintenance`

`PATCH /admin/maintenance/:id`

`DELETE /admin/maintenance/:id`