Incident.io API Keys V1 API

Manage API keys for your organization. This API lets you view, create, update, delete, and rotate API keys programmatically, including configuring account-level roles and roles scoped to specific teams. Common use cases include: - **API key rotation**: You can issue a new access token for any API key using the `Rotate` endpoint. - **Managing keys at scale**: use the `Show`, `List`, `Create`, `Update`, and `Delete` endpoints to automate API key lifecycle management. ## Permissions model To use these endpoints, your API key must have the `api_keys_manage` role granted at either the account level or for specific teams. In addition, the following rules apply, when a "caller" API key is managing a "target" API key: - A caller key can only assign roles whose scopes are a subset of its own scopes. For example, a key with `viewer` and `incident_creator` can assign those roles to a target key, but cannot assign the `incident_editor` role, since it has additional scopes. - The same applies at the team level: A caller key with `schedules_editor` at the account level can create a target key with that role for a specific team, but a key with `schedules_editor` only for one team (Team A, say) cannot assign it at the account level or for another team, Team B. - The `api_keys_manage` role cannot be assigned via the API. To create a key with that role, you must go to Settings → API keys in the dashboard, and click "Add new", creating a key with the "View, create, edit, delete or rotate API keys" role (`api_keys_manage`). - The `Delete` endpoint does not check whether the calling API key holds the scopes of the key being deleted. However, a team-scoped key can only delete keys belonging to its teams. - To rotate the token of an API key, use the Rotate endpoint or by clicking "Rotate token" on any API key listed in the dashboard. The same permissions limitations apply as when creating or updating an API key. ## Finding role names and team IDs To find valid values for `role_names`, `team_ids`, and `team_role_names`, go to Settings → API keys in the dashboard. Click to either edit an existing key or create a new one, select the desired roles and teams, and then use the copy button to get hold of the role and team identifiers as JSON.

Operations 6

GET /v1/api_keys List API Keys V1 #
POST /v1/api_keys Create API Keys V1 #
DELETE /v1/api_keys/{id} Delete API Keys V1 #
GET /v1/api_keys/{id} Show API Keys V1 #
PUT /v1/api_keys/{id} Update API Keys V1 #
POST /v1/api_keys/{id}/actions/rotate Rotate API Keys V1 #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API
curl "https://apis.io/api/v1/apis/incident-io:incident-io-api-keys-v1-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

incident-io-api-keys-v1-api-openapi.yml Raw ↑
openapi: 3.2.0
info:
  description: 'This is the API reference for incident.io. It documents available API endpoints, provides examples of how to use it, and

    instructions around things like authentication and error handling. The API is hosted at:


    - https://api.incident.io/


    And you will need to create an API key via your incident.io

    dashboard to make requests. # Making requests


    Here are the key concepts required to make requests to the incident.io API. ## Authentication


    For all requests made to the incident.io API, you''ll need an API key. To create an API key, head to the incident dashboard and visit API

    keys. When you create the key, you''ll be able to choose what actions it

    can take for your account: choose carefully, as those roles can only be set

    when you first create the key. We''ll only show you the token once, so make sure

    you store it somewhere safe. API keys are global to your incident.io account, and can be managed by anyone

    who has the right permissions. We display the user that created the API key,

    and the API key will remain valid if that user becomes deactivated. Once you have the key, you should make requests to the API that set the

    `Authorization` request header using a "Bearer" authentication scheme:


    ```

    Authorization: Bearer

    ```


    ## Rate Limits


    The incident.io API enforces rate limits to ensure consistent performance for all users. The default rate limit is 1200 requests/minute per API key. This limit applies to most endpoints across the API. Limits are token buckets that refill continuously rather than resetting on a fixed window boundary. The default

    bucket holds 1200 requests and refills at 20 per second, so you can burst up to the full bucket and then sustain

    20 requests/second indefinitely. There is no boundary at which your quota resets to full in one step. Some endpoints have lower rate limits, particularly those that interact with external third-party systems that impose

    their own limitations. These specific limits vary by endpoint. ### Rate limit headers


    Responses to requests authenticated with an API key carry your current allowance, so you can pace yourself rather

    than waiting to be throttled:


    ```

    X-RateLimit-Limit: 60, 1200;window=60, 60;window=60

    X-RateLimit-Remaining: 59

    X-RateLimit-Used: 1

    X-RateLimit-Reset: 1785173199

    ```


    | Header | Meaning |

    | --- | --- |

    | `X-RateLimit-Limit` | The quota that binds this request, followed by every limit that applied and the window it applies over |

    | `X-RateLimit-Remaining` | Requests you can make right now against the binding limit |

    | `X-RateLimit-Used` | Requests you have spent against it |

    | `X-RateLimit-Reset` | Unix timestamp (seconds) at which that limit will be back to full |


    More than one limit can apply to a request: your API key''s overall limit, and for some endpoints a lower limit of

    their own. `X-RateLimit-Limit` lists all of them, each with its window, so `1200;window=60` means 1200 requests per

    minute. Because our limits refill continuously rather than resetting on a boundary, that window is what tells you

    the rate you can sustain: 1200 per 60 seconds is 20 requests/second indefinitely. `Remaining`, `Used` and `Reset` describe whichever limit has the least allowance left, since that is the one you

    will hit first. `X-RateLimit-Remaining` may lag by a small number of requests under high concurrency, and can move by more than the

    requests you made, because limits scoped to your whole organisation are shared with your other API keys. Headers are omitted rather than guessed if we cannot determine your allowance for a request. ### Exceeding a rate limit


    When you exceed a rate limit the API responds with `429 Too Many Requests` and a `Retry-After` header giving the

    number of seconds to wait:


    ```

    X-RateLimit-Limit: 1200, 1200;window=60

    X-RateLimit-Remaining: 0

    X-RateLimit-Used: 1200

    X-RateLimit-Reset: 1785173199

    Retry-After: 1

    ```


    Prefer `Retry-After` over `X-RateLimit-Reset` when deciding how long to back off.'
  title: incident.io API Keys V1 API
  version: 1.0.0
servers:
- url: https://api.incident.io
security:
- BearerAuth: []
tags:


# --- truncated at 32 KB (72 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/incident-io/refs/heads/main/openapi/incident-io-api-keys-v1-api-openapi.yml