The Event Management plugin's API

Under /api/v1/x/events, 404 while the plugin is off; events:read and events:write. Guide: events. Events from monitoring arrive through an integration whose endpoint feeds the target events.event.

Endpoint	What
GET ?state=&severity=&ciId=&ci=none&serviceId=&incidentId=&integrationId=&q=&orgId=&page=&pageSize=	Events you can see, most recently seen first. state: live (not closed, the default), all, or states, comma-separated (open, acknowledged, suppressed, closed); severity: one or more of critical, major, minor, warning, info; ci=none: not matched to a CI; q: words in the message, alert name or the host and service the source named, or a key like EVT-12.
GET report?days=&tz=&orgId=	The dashboard's figures (needs event.dashboard): { received, raised, linked, suppressed, noise, live, unmatched, acknowledgeMedianMinutes, clearMedianMinutes, daily, severities, sources, noisiest, cis }.
GET count	{ open, live, urgent, unmatched, bySeverity }: open events, those not closed (by severity), Critical and Major ones, and those without a CI.
POST	Report an event: { unitId, message, severity, description, sourceKey, sourceName, name, ci, service, url, occurredAt }. ci and service take an id or what the source calls them (a host name, FQDN or IP; a service code or name). With a sourceKey, a second report updates the event while it isn't closed, and reopens it within an hour of closing. Needs event.write in the unit.
GET <id or key>	The event: its CI, service and incident, the source, the history (entries), the alert as it came (raw), change ({ id, key }, the change it was suppressed during, or null), and canWrite.
PATCH <id>	{ ciId, serviceId }: set the CI or the service by hand; null clears it.
POST acknowledge, POST close	{ ids }, and for closing a note: { acknowledged } or { closed }, how many changed. Closing is audited (events.closed) with the note.
POST <id>/incident	Raise an incident from the event: { title, impact, urgency, commanderId }, all optional (the message; impact and urgency from the severity). Answers { event, incident: { id, key } }; 400 already_linked. Needs the right to declare incidents in the unit too.
POST <id>/link, POST <id>/unlink	{ incident } (an id or key, INC-12, of an incident you can see; 400 unknown_incident); unlink takes no body.

An open event that is raised or linked is acknowledged. A new event on a CI or service with an open incident is linked to it. While a change is in progress on its CI or service, an event is suppressed: no health, no automations; when the change ends and it still fires, it opens again and its created rules run. Rules on events use the subject events.event in the Automations API. A Critical event that isn't closed sets its CI (or service) to an outage, a Major one to degraded.

Webhook events

events.created, events.severity_changed, events.acknowledged, events.closed (with reason: cleared or closed), events.reopened and events.incident_linked, each with the event's id and key.

MCP tools

Scope	Tools
events:read	list_events (not closed by default; by state, severity, CI, service, words), get_event (by key or id), events_report (the dashboard's figures, with event.dashboard)
events:write	acknowledge_events, close_events (with a note), raise_incident_from_event, link_event_to_incident