---
title: "Save Postmortem"
description: "Saves the public postmortem (Markdown) of an incident as a draft, or replaces the text of a published one."
---

`PUT /api/incidents/:id/postmortem`

Saves the public postmortem of an incident: what happened, why, and what was changed, written in Markdown. Like on Atlassian Statuspage, the postmortem is shown under the incident on every status page the incident appears on, once it is published with [Publish Postmortem](/api/monitoring/publish-postmortem). Until then it is a draft, visible only in the status pages module.

An incident has at most one postmortem; this call creates it or replaces its text. On a published postmortem the new text goes live immediately and it stays published. Saving sends no notification. The text can be saved at any time, publishing needs a resolved incident.

The status pages render the Markdown themselves and never as raw HTML: headings, paragraphs, lists, **bold**, *italic*, `code` and links to `http(s)` addresses. Anything else, including HTML tags, is shown as plain text.

## Authentication

Requires role `admin` or `editor` within the incident's customer scope. An incident without a customer needs an organization-wide role or token; for any other organization it answers `404 incidentNotFound`. `readonly` gets `403 forbidden`.

- Header: `Authorization: Bearer <token>`

## Path Parameters

- `id` (required): numeric id or `publicId` (UUID) of the incident.

## Request Body

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `body` | string | yes | Markdown, 1 to 50,000 characters after trimming. |

Unknown fields are rejected with `400 invalidRequestBody`.

## Example (cURL)

```bash
curl -X PUT "$BASE_URL/api/incidents/5121/postmortem" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "body": "## Cause\nA database node ran out of disk space.\n\n## Actions\n- Alert at 80 % disk usage" }'
```

## Response

`200 OK`

```json
{
  "incidentId": 5121,
  "incidentPublicId": "8a3c1f6e-2b7d-4e59-9c1a-5d2e7f0b4c33",
  "body": "## Cause\nA database node ran out of disk space.\n\n## Actions\n- Alert at 80 % disk usage",
  "publishedAt": null,
  "updatedAt": "2026-10-28T14:02:11.000Z"
}
```

| Field | Description |
|-------|-------------|
| `publishedAt` | `null` = draft; otherwise when it was published (ISO 8601). |
| `updatedAt` | When the text was last saved. |

[Get Incident Details](/api/monitoring/get-incident-details) returns the same fields as `postmortem`.

## Common Errors

- `400 Bad Request` (`invalidRequestBody`) when `body` is missing, empty, longer than 50,000 characters, or an unknown field is sent
- `400 Bad Request` (`incidentNoCustomer`) when the incident has neither a customer nor a status page
- `401 Unauthorized` when not authenticated
- `403 Forbidden` (`forbidden`) when your role or customer scope does not allow it
- `404 Not Found` (`incidentNotFound`) when the incident does not exist in your organization