Available · v1

Incident Intelligence

Send an incident report with its impact, metrics, and your severity policy. Get back the incident type, a severity with its basis, whether to escalate, and the recommended handling.

  • Your severity policy applied exactly, rule by rule
  • Metric thresholds evaluated in code
  • Provisional severity clearly labeled when no policy is sent
  • Never invents root causes or confirms security incidents
Try it in the playgroundAPI reference
Request body
{
  "title": "Checkout API returning 503s",
  "description": "Since 14:05 UTC most checkout requests fail with 503 Service Unavailable. Customers can't complete orders.",
  "affected_services": [
    {
      "name": "checkout-api",
      "criticality": "critical"
    }
  ],
  "customer_impact": {
    "affected_percent": 82,
    "revenue_impacting": true
  },
  "metrics": [
    {
      "name": "error_rate",
      "value": 81.5,
      "threshold": 5,
      "breach_when": "above",
      "unit": "%"
    },
    {
      "name": "p95_latency",
      "value": 420,
      "threshold": 800,
      "breach_when": "above",
      "unit": "ms"
    }
  ],
  "severity_policy": {
    "rules": [
      {
        "severity": "critical",
        "min_affected_percent": 50,
        "service_criticality": [
          "critical"
        ]
      },
      {
        "severity": "critical",
        "incident_types": [
          "security"
        ]
      },
      {
        "severity": "high",
        "revenue_impacting": true
      },
      {
        "severity": "high",
        "min_affected_percent": 10
      },
      {
        "severity": "medium",
        "metric_breach": true
      }
    ],
    "default_severity": "low"
  }
}
Response · 200 OK
{
  "request_id": "req_Kw3nR7tLm1VqB5zP",
  "incident_type": "availability",
  "severity": "critical",
  "severity_basis": "policy",
  "matched_policy_rule": 0,
  "requires_escalation": true,
  "recommended_action": "activate_incident_response",
  "signals": [
    "metric_threshold_breached",
    "service_unavailable",
    "critical_service_affected",
    "revenue_impact"
  ],
  "breached_metrics": [
    "error_rate"
  ],
  "missing_information": []
}
The problem

Every incident gets triaged differently

Reports arrive from customers, monitors, and engineers in different words. Severity depends on who's on call, and the incidents that matter can wait behind the noisy ones.

Classification
Availability, performance, security, data integrity, integration failure, configuration, or other.
Policy-driven severity
Rules on incident type, affected users, service criticality, revenue impact, and metric breaches, evaluated in order.
Safe escalation
Possible security incidents always escalate; contradictory telemetry is investigated before a provisional severity is acted on.
Use cases

Where teams use it

  • Incident intake
  • On-call routing
  • Status triage
  • Customer-reported outages
  • Managed service providers
Integrate

One HTTP call

const response = await fetch("https://kovca.io/api/v1/incidents/triage", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.KOVCA_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "title": "Checkout API returning 503s",
    "description": "Since 14:05 UTC most checkout requests fail with 503 Service Unavailable. Customers can't complete orders.",
    "affected_services": [
      {
        "name": "checkout-api",
        "criticality": "critical"
      }
    ],
    "customer_impact": {
      "affected_percent": 82,
      "revenue_impacting": true
    },
    "metrics": [
      {
        "name": "error_rate",
        "value": 81.5,
        "threshold": 5,
        "breach_when": "above",
        "unit": "%"
      },
      {
        "name": "p95_latency",
        "value": 420,
        "threshold": 800,
        "breach_when": "above",
        "unit": "ms"
      }
    ],
    "severity_policy": {
      "rules": [
        {
          "severity": "critical",
          "min_affected_percent": 50,
          "service_criticality": [
            "critical"
          ]
        },
        {
          "severity": "critical",
          "incident_types": [
            "security"
          ]
        },
        {
          "severity": "high",
          "revenue_impacting": true
        },
        {
          "severity": "high",
          "min_affected_percent": 10
        },
        {
          "severity": "medium",
          "metric_breach": true
        }
      ],
      "default_severity": "low"
    }
  }),
});

if (!response.ok) {
  const { error, request_id } = await response.json();
  throw new Error(`${error.code}: ${error.message} (${request_id})`);
}

const { incident_type, severity, recommended_action } = await response.json();

Related APIs

  • Support Triage

    Classify inbound support tickets by category and priority, and flag the ones a person should review.

  • Shipment Intelligence

    Interpret shipment tracking exceptions and route each one to the right workflow.

  • Lead Intelligence

    Qualify inbound leads by stated intent and your criteria, and recommend follow-up priority.