---
title: "Resolve Incident"
description: "Resolves an Incident Management incident from any non-closed status. This is the only endpoint that can move an incident to resolved."
---

`POST /api/im/incidents/:id/resolve`

Resolves an incident from any non-closed status (`triggered`, `acknowledged`, `investigating`, `identified`, `monitoring`). This is the only endpoint that can move an incident to `resolved`. [Acknowledge / Update Incident Status](./acknowledge-incident) deliberately rejects `resolved` as a target.

## Authentication

Same as [List Incidents](./list-incidents): any IM-eligible role (`admin`, `editor`, `responder`), or an organization-wide API token. Incident Management must be enabled for the organization.

## Request Body

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `note` | string | No | `null` | Optional free-text resolution note, up to 10,000 characters. |

## Example (cURL)

```bash
curl -X POST "$BASE_URL/api/im/incidents/42/resolve" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "note": "Restarted the connection pool, monitoring for recurrence." }'
```

## Response

`200 OK`: the updated incident row (same shape as [List Incidents](./list-incidents)' `items`).

```json
{
  "id": 42,
  "organizationId": 1,
  "teamId": 3,
  "title": "Database connection pool exhausted",
  "customerId": null,
  "primarySourceId": 7,
  "severity": "sev1",
  "severityManual": false,
  "status": "resolved",
  "mergedIntoId": null,
  "escalationPolicyId": 5,
  "currentTier": null,
  "escalationEpoch": 1,
  "acknowledgedBy": "u_abc123",
  "acknowledgedAt": "2026-07-17T09:20:00.000Z",
  "snoozedUntil": null,
  "autoResolve": true,
  "resolvedBy": "u_abc123",
  "resolveNote": "Restarted the connection pool, monitoring for recurrence.",
  "createdBy": null,
  "sourceKind": "alert",
  "triggeredAt": "2026-07-17T09:12:00.000Z",
  "resolvedAt": "2026-07-17T09:45:00.000Z"
}
```

Resolving also cancels any pending escalation jobs for the incident's current escalation cycle.

## Common errors

- `401 Unauthorized` when not authenticated
- `403 Forbidden` (`imAccessDenied`) when using a customer-scoped token, or a session without an IM-eligible role
- `403 Forbidden` (`imNotEnabled`) when Incident Management is not enabled for the organization
- `400 Bad Request` (`invalidRequestBody`) when `:id` is not a positive integer, or `note` is not a string or exceeds 10,000 characters
- `404 Not Found` (`imIncidentNotFound`) when the incident does not exist, or belongs to another organization
- `422 Unprocessable Entity` (`imIncidentAlreadyClosed`) when the incident is already `resolved` or `merged`
- `409 Conflict` (`imIncidentStatusConflict`) when the incident was closed concurrently between the read and the write, safe to retry