List
Read live records straight from the Incident API.
- Source
- Engineering Analytics
- Generally available
- 13 entities
Move Incident data anywhere it matters.
Move Incident actions, alert attributes and alert routes into your warehouse, lake or AI app.
Source
Incident
Snowflake
BigQuery
Postgres
Databricks
Claude
- Streams
- 24
- Incremental streams
- 4
- Entities
- 13
- Actions
- 4
- Destinations
- 50+
- Standard support
- 1.0.3
Overview
What is the Airbyte Incident connector?
The Airbyte Incident connector extracts data from Incident and loads it into 50+ destinations such as Snowflake, BigQuery, Databricks or Postgres, with full refresh and incremental sync. It publishes 24 streams you can select per connection.
- 01
Sync to your warehouse
Land 24 Incident tables in 50+ destinations on a schedule you control.
- 02
Context store search
Query synced Incident data with filters, sorting and semantic search, without spending Incident API rate limits.
- 03
Incremental syncs
Pull only the records that changed since the last run instead of reloading everything.
- 04
One authorization
Authenticate Incident once. The same connection powers scheduled syncs and runtime actions.
24 streams
Every table you can sync from Incident
actionsIncremental Primary key id Sync modes FullIncr. alert_attributes Primary key id Sync modes FullIncr. alert_routes Primary key id Sync modes FullIncr. alert_sources Primary key id Sync modes FullIncr. alertsIncremental Primary key id Sync modes FullIncr. catalog_entries Primary key id Sync modes FullIncr.
Setup
Live in seven steps
Log into your Airbyte Cloud account.
Click Sources and then click + New source.
On the Set up the source page, select Incident.io from the Source type dropdown.
Enter a name for the Incident.io connector.
For API Key, enter the key you created in Step 1.
(Optional) Set Start Date, Time window, and Number of concurrent workers. See Configuration options.
Click Set up source.
Configuration fields
| Field | Type | Description |
|---|---|---|
| api_key* | string | An Incident.io API key with view permission for the streams you sync. Create it in Incident.io under Settings > API keys. See https://docs.incident.io/api-reference/introduction#authentication |
| num_workers | integer | Number of streams and partitions read in parallel. Higher values can speed up large syncs but use more of the incident.io rate limit (1,200 requests per minute per API key, 60 per minute on incidents). Defaults to 4. |
| start_date | string | Only sync records updated on or after this UTC date for the incremental streams (incidents, alerts, escalations, actions, follow-ups). The default predates all incident.io data, so everything is synced. Streams read per incident, such as incident_attachments, follow the same scope and only cover incidents updated on or after this date. |
| time_window | string | Size of each date window requested from incident.io on incremental streams, in whole days as an ISO 8601 duration (for example P30D, P7D, P365D). The minimum is P1D because incidents and escalations filter by date. Smaller windows let more requests run in parallel on large accounts; larger windows mean fewer requests on small accounts. Defaults to P30D. |
4 actions
Supported Incident actions
Get
Fetcha single record by ID.Context Store Search
Query synced data with filters and sorting, with no API rate limits.
Semantic Search
Natural-language search across synced Incident records.
Full parameter-level details live in the Incident entity reference.
Hybrid deployment
Sovereign by architecture, not by policy.
The data plane runs in your environment. Records, credentials and keys stay with you; the control plane only receives configuration and job metadata.
- Cloud
- OSS
- Hybrid
Your environment
Airbyte control plane
Use cases
What teams build with Incident
List all incidents
Show all open incidents
List all alerts
Show all users
List all escalations
Show all on-call schedules
List all severities
Show all incident statuses
List all custom fields
List all teams
Which incidents were created this week?
What are the most recent high-severity incidents?
Who is currently on-call?
How many incidents are in triage status?
What incidents were updated today?
FAQ
Incident connector questions
Do I need more than one Incident connection?
No. One Incident authorization powers both the scheduled syncs that land data in your destination and the entity actions your agents call at runtime.
Do Incident entity actions need a sync to run first?
No. Entity actions read and write through the Incident API as they are called, so they work immediately. Context store search is the exception: it queries data Airbyte has already synced, which is what lets it filter and sort without spending API rate limits.
What data can I sync from Incident with Airbyte?
24 streams, including actions, alert attributes, alert routes, alert sources, alerts, catalog entries, catalog resources, catalog types and more.
Does the Incident connector support incremental sync?
Yes. actions, alerts, escalations, incidents support incremental sync, and every documented stream supports full refresh.
Where can I run the Incident connector?
Run the Incident connector on Cloud, OSS, Hybrid. Hybrid deployments keep the data plane in your environment while the control plane orchestrates syncs.
Didn't find your answer? Talk to sales
Start syncing Incident in minutes.
Free 14-day trial. One connection powers your scheduled syncs and your live Incident actions.