What permissions should my incident.io API token have?

Create an API token in incident.io from Settings > API keys. Choose permissions based on how you will use the integration:

Choose permissions for your workflow

• Search for or link existing non-private incidents: Grant “View data, like public incidents and organisation settings.”

• Create incidents or escalations: For Pylon trigger actions or manual creation, grant the token the corresponding creation permissions. “Create incidents” is needed to create incidents; grant the relevant escalation creation permission for escalations. View access alone does not authorize creation.

When do I need a workspace owner or custom role?

A non-owner incident.io API token role works for most Pylon functionality, including creating and linking new incidents and escalations through Pylon triggers when the appropriate creation permissions are granted. You do not need a workspace-owner token for those ordinary workflows.

The exception is access to private incidents. To search for, link, or display private incident.io incidents in Pylon, the token needs “View all incident data, including private incidents” or “View all incident data, including private incidents, and manage incident memberships for them.” These scopes are limited to workspace owners or custom roles with Private Incidents Global Access. They are not required if you only work with non-private incidents.

Scopes to select in incident.io

Use the scopes that match your workflow:

• View data, like public incidents and organisation settings

• Create incidents

• Edit incidents

• View all incident data, including private incidents

• View all incident data, including private incidents, and manage incident memberships for them