---
title: Incidents in the API and MCP now say what was detected
description: An assistant reading an incident through the API or MCP got the rule that fired but not what the probe actually saw, so it could not tell you the site…
canonical: https://watchfor.io/changelog/2026-09-22-incident-root-cause-in-api
---

[All updates](/changelog/page/2#2026-09-22-incident-root-cause-in-api) ⚡ Improved Sep 22, 2026 · v 8.2.0

# Incidents in the API and MCP now say what was detected

An assistant reading an incident through the API or MCP got the rule that fired but not what the probe actually saw, so it could not tell you the site answered 404. Every incident now carries root_cause (expected vs detected, e.g. "HTTP Status Code = 404"), the fire-time trigger snapshot (the metrics the probe reported, which locations confirmed, the rule expression and threshold), fire_count and flapping — the same facts the incident page shows. GET /v1/incidents/{id} adds the event timeline. Values under sensitive keys are redacted.

## The problem

Ask an assistant "why is checkout down?" and, through the API, it could only repeat the rule: Unexpected Status Code fired . The incident page in the dashboard showed that the site was answering 404 from two locations. The API didn't.

## What every incident carries now

- root_cause : what was expected and what was detected, in words.

- trigger : the snapshot taken when the incident opened. It has the metrics the check reported, which locations confirmed the failure, the rule expression and its threshold.

- fire_count and flapping : how many times the rule fired, and whether the monitor keeps flipping between up and down.

- timeline , only on GET /v1/incidents/{id} : every event in order, ending with the exact duration once it resolves.

## Example

"root_cause": {
"title": "Unexpected Status Code",
"expected": "HTTP status code in 2xx or 3xx",
"detected": "HTTP Status Code = 404"
},
"trigger": {
"metrics": { "http.status_code": 404, "http.response_time_ms": 182 },
"expression": "metrics['http.status_code'] >= 400",
"failure_threshold": 2
}

With that, the assistant can answer "the checkout page returns 404, confirmed from two locations, and it started at 10:14". That's a reply you can act on.

Values under sensitive keys, such as tokens and passwords, are redacted. The get_incident MCP tool returns the same fields. See [Incidents](/docs/api/incidents#get-an-incident) in the API docs.

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-09-22-incident-root-cause-in-api · Site guide: https://watchfor.io/llms.txt