From the consoleNeeds a repository

Investigate an incident

A report with evidence

Hand the agent an incident and read access to its sources; it comes back with a report that cites what it found, and no code change.

View .md

Best for

On-call engineers who want a first pass before they dig in
Incidents where the evidence spans logs, code and recent changes

Uses

A Project
A connection to where the evidence lives, such as an MCP server

From the console

POST /o/{org}/sessions

{
  "harness": "claude",
  "input": "Checkout errors rose at 14:05 UTC. Find the cause from recent deploys and the logs. Write incident.md with a timeline and evidence. Change no code.",
  "resources": [
    {
      "url": "https://github.com/acme/web"
    }
  ]
}

Fig. The request. Field names are the API's; the values are an example.

Watch it work, then read what comes back

GET /o/{org}/sessions/{session}/events

event: tool_usebash · git log --since='2 hours ago'

event: thinkingA config change at 14:02 lowered the pool size.

event: tool_usewrite · incident.md

event: messageLikely cause: the 14:02 pool-size change. Evidence in incident.md.

Fig. The live stream while it works. Event names are the stream's.

GET /o/{org}/sessions/{session}

status: completed
result: Likely cause: the 14:02 config change
artifacts: [{ name: "incident.md", url: … }]

Fig. The session when it ends. Field names are the API's.

Steps

01
Connect the sources
Add the connections the agent needs to read the evidence, and name them on the run.
02
Start the run
From the console, the CLI or the API. Ask for a report and say not to change code.
03
Read the report
The report is the run's artifact; the trajectory beside it shows every query and command behind each claim.