canonical: https://jentic.com/apis/amazonaws.com/aws-ssm-incident-manager # AWS Systems Manager Incident Manager Jentic publishes the only available OpenAPI specification for AWS Systems Manager Incident Manager, keeping it validated and agent-ready. Incident Manager helps responders mitigate and recover from outages affecting AWS-hosted applications by automating response plans, escalation, and incident-record collaboration. Agents can create response plans with engagement contacts and runbooks, start incidents with StartIncident, append timeline events, list and update incident records, and manage cross-region replication sets. The 29 operations cover incident records, response plans, replication sets, timeline events, related items, and resource policies. ## For AI agents Coordinate on-call response to AWS incidents through Incident Manager. Agents can start incidents, attach timeline events, manage response plans, and update incident records. ## Scope Does not collect metrics, evaluate alarms, or run runbook automation directly - use for orchestrating the incident lifecycle and response plans only. ## Capabilities - Create response plans with engagements, runbooks, and escalation chains via CreateResponsePlan - Start a new incident from a response plan using StartIncident - Append timeline events to an open incident with CreateTimelineEvent - Update incident impact, status, and summary fields with UpdateIncidentRecord - Attach related items (Jira tickets, runbook links, dashboards) via UpdateRelatedItems - Manage cross-region replication sets so incident data survives a regional outage - Apply resource-based policies to share response plans across accounts ## Use cases ### Automated Paging When CloudWatch Alarms Trigger Operations teams wire CloudWatch alarms to Incident Manager response plans so that an alarm in ALARM state automatically starts an incident, pages the on-call engagement, and opens the runbook. Agents can create the plan with CreateResponsePlan referencing engagements and runbook ARNs, then leave incident creation to EventBridge. Example prompt: CreateResponsePlan with name='checkout-p1', a high-impact value, an Engagements array referencing the Incident Manager contact ARN, and a SsmAutomation block pointing at a runbook document. ### Incident Record Enrichment During Triage During an active incident, responders enrich the record with context: posting timeline events as new findings emerge, attaching Jira tickets and dashboard URLs as related items, and updating the impact field as the blast radius is understood. The incident record becomes the canonical source for post-incident review. Example prompt: Call CreateTimelineEvent on the open incident with eventType=Custom Event and eventData='Database failover initiated', then UpdateRelatedItems to add a Jira link with itemType=ATTACHMENT. ### Multi-Region Replication Set Setup Incident Manager replicates incident data across regions so a regional outage does not destroy the operating record. CreateReplicationSet defines the regions, GetReplicationSet inspects state, and UpdateReplicationSet adds or removes regions when the topology changes. Example prompt: CreateReplicationSet with two regions (us-east-1 and us-west-2), then GetReplicationSet to confirm Status=ACTIVE in both. ### AI Agent Incident Triage via Jentic AI agents using Jentic can drive incident operations from chat: starting incidents, posting timeline updates, and attaching related items as the situation evolves. Through Jentic, the agent searches by intent, loads the operation schema, and executes against vault-stored AWS credentials. Example prompt: Search Jentic for 'start an incident from a response plan', execute StartIncident with the response plan ARN and an impact of 2, then CreateTimelineEvent to record the agent's first observation. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /createResponsePlan | Create a reusable response plan | | POST | /createTimelineEvent | Append a timeline event to an incident | | GET | /getIncidentRecord#arn | Fetch an incident record by ARN | | POST | /listIncidentRecords | List incident records with optional filters | | POST | /createReplicationSet | Create a cross-region replication set | | GET | /getReplicationSet#arn | Get the replication set configuration | | POST | /listRelatedItems | List related items attached to an incident | | POST | /deleteIncidentRecord | Delete an incident record | ## Key resources - **Incident Records** — Active and historical incidents; StartIncident, GetIncidentRecord, UpdateIncidentRecord, ListIncidentRecords - **Response Plans** — Reusable incident playbooks; CreateResponsePlan, GetResponsePlan, UpdateResponsePlan, DeleteResponsePlan, ListResponsePlans - **Timeline Events** — Time-stamped activity on an incident; CreateTimelineEvent, GetTimelineEvent, UpdateTimelineEvent, DeleteTimelineEvent, ListTimelineEvents - **Related Items** — External attachments and links; ListRelatedItems, UpdateRelatedItems - **Replication Sets** — Cross-region replication topology; CreateReplicationSet, GetReplicationSet, UpdateReplicationSet, DeleteReplicationSet, ListReplicationSets - **Resource Policies** — Cross-account sharing; PutResourcePolicy, GetResourcePolicies, DeleteResourcePolicy ## Why Jentic - **Setup:** Wiring AWS Systems Manager Incident Manager by hand means computing SigV4 signatures on each request and picking the right regional ssm-incidents host yourself. Through Jentic you install once, import Incident Manager from the API Directory, store the access keys once, and your agent calls it. - **Permission scoping:** Incident Manager exposes records as ARNs and paths like /getIncidentRecord, so scope the agent to the operations it needs, such as createTimelineEvent and listIncidentRecords. You choose the operations it may call, so destructive ones like deleteIncidentRecord are not included unless you add them. - **Credential handling:** Your AWS access keys are stored once, encrypted, by your own Jentic One instance and used to sign each Incident Manager request with SigV4 at execution time. They never enter the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'start an incident' or 'append a timeline event', and Jentic returns the matching Incident Manager operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Amazon EventBridge** — Event bus that triggers Incident Manager response plans on alarm state changes - **Amazon CloudWatch** — Metrics and alarms that surface the conditions Incident Manager responds to - **Amazon CloudWatch Logs** — Log queries that responders run during an Incident Manager incident ## FAQ ### Why is there no official OpenAPI spec for AWS Systems Manager Incident Manager? AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS Systems Manager Incident Manager via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the AWS Systems Manager Incident Manager use? Incident Manager uses AWS Signature Version 4 with IAM credentials and permissions on the ssm-incidents:* actions. Through Jentic, the AWS access key and secret are stored encrypted in the vault - Jentic signs each call before forwarding it to the regional Incident Manager endpoint. ### Can I start an incident programmatically? Yes. StartIncident creates an incident record from an existing response plan ARN. The call accepts impact (1-5), title, triggerDetails, and an optional relatedItems array. Engagements defined on the response plan execute automatically once the incident starts. ### What are the rate limits for the AWS Systems Manager Incident Manager? Incident Manager applies standard AWS API throttling - most operations are limited to a few requests per second per account per region with short bursts. Throttled requests return ThrottlingException; clients should retry with exponential backoff. ### How do I append a timeline event to an open incident through Jentic? Through Jentic, search for 'create timeline event incident manager', load the CreateTimelineEvent schema, and execute with the incidentRecordArn, eventType, eventData, and eventTime. Jentic returns the eventId for follow-up updates. ### Is AWS Systems Manager Incident Manager free? Incident Manager charges per incident started, per engagement, and per response plan run. SMS and voice-call engagements have additional per-event costs; see https://aws.amazon.com/systems-manager/pricing/incident-manager/ for the current rates. ### Can I limit what my agent is allowed to do with the AWS Systems Manager Incident Manager API? Yes. Because you run Jentic One yourself, your own rules decide which Incident Manager operations the agent may call and which AWS credentials it may use. You can allow read and append operations like listIncidentRecords, getIncidentRecord, and createTimelineEvent while withholding destructive ones such as deleteIncidentRecord and deleteResponsePlan. Only the operations you grant are exposed to the agent, so it can enrich and track incidents without ever being able to remove records or replication sets.