# Investigate an incident

Returns: A report with evidence. Starts: from the console.

Hand the agent an incident and read access to its sources; it comes back with a report that cites what it found, and no code change.

## Best for

- On-call engineers who want a first pass before they dig in
- Incidents where the evidence spans logs, code and recent changes

## Uses

- A Project
- A connection to where the evidence lives, such as an MCP server

## The request

`POST /o/{org}/sessions`

```json
{
  "harness": "claude",
  "input": "Checkout errors rose at 14:05 UTC. Find the cause from recent deploys and the logs. Write incident.md with a timeline and evidence. Change no code.",
  "resources": [
    {
      "url": "https://github.com/acme/web"
    }
  ]
}
```

## While it works

Live stream events (`GET /o/{org}/sessions/{session}/events`):

- `tool_use`: bash · git log --since='2 hours ago'
- `thinking`: A config change at 14:02 lowered the pool size.
- `tool_use`: write · incident.md
- `message`: Likely cause: the 14:02 pool-size change. Evidence in incident.md.

## What comes back

- `status`: completed
- `result`: Likely cause: the 14:02 config change
- `artifacts`: [{ name: "incident.md", url: … }]

## Steps

1. **Connect the sources.** Add the connections the agent needs to read the evidence, and name them on the run.
2. **Start the run.** From the console, the CLI or the API. Ask for a report and say not to change code.
3. **Read the report.** The report is the run's artifact; the trajectory beside it shows every query and command behind each claim.

Field names are the API's; the values are an example.