---
title: "Set Incident Service"
description: "Names the service an Incident Management incident affects, or removes it."
---

`POST /api/im/incidents/:id/service`

Sets the affected [service](/api/incident-management/services) of an incident by hand, or removes it with `null`. Allowed in every status, also after the incident is resolved. Purely descriptive: nobody is paged, no status page or outbound integration is notified. The change is written to the incident timeline (`service_changed`, payload `{ from, to }` with `{ id, name }` or `null`) and to the organization audit log. A call that changes nothing writes nothing.

## Authentication

Any IM-eligible role or an organization-wide API token, see [Authentication](/api/incident-management#authentication). You must be a member of the incident's team or an organization `admin`.

## Request Body

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `serviceId` | integer \| string \| null | Yes | `id` or `publicId` of a service of the incident's organization; `null` removes the service. |

```bash
curl -X POST "$BASE_URL/api/im/incidents/42/service" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "serviceId": 4 }'
```

## Response

`200 OK`: the updated incident row (same shape as the `items` of [List Incidents](/api/incident-management/list-incidents), without the enrichment fields), with `serviceId` set.

## Common errors

- `401 Unauthorized` when not authenticated
- `403 Forbidden` (`imTeamMembershipRequired`) when you are not a member of the incident's team and not an organization `admin`
- `400 Bad Request` (`invalidRequestBody`) when `serviceId` is missing or neither an integer, a UUID nor `null`
- `404 Not Found` (`imIncidentNotFound`) when the incident does not exist or belongs to another organization
- `404 Not Found` (`imServiceNotFound`) when the service does not exist or belongs to another organization