Update an RCA by incident or external ID
Tool: oppex.incident.updateRCAByIdentifier
Adds a root cause analysis (RCA) to an incident, or replaces the one it has, without resolving it. You can point at the incident with its Oppex incident ID, or with the external ID: the ID your monitoring tool gave the alert, such as a New Relic or PagerDuty incident ID.
What you provide
| Input | Required | Description |
|---|---|---|
| Incident ID or external ID | One of the two | The Oppex incident ID, or the source tool's ID for the alert. When you give both, Oppex uses the incident ID. |
| Reason for alert | Yes | Issue Summary in Oppex. |
| Action taken | Yes | Root Cause in Oppex. |
| Type of fix | Yes | Fix Status: Permanent or Temporary. |
| Ticket link | For a temporary fix | A link starting with http:// or https://. |
| ETA for permanent fix | For a temporary fix | A date and time. |
| Additional notes | No | Remarks in Oppex. |
The same field rules as Resolve with an RCA apply.
Example prompts
- "Record an RCA on the incident with external ID NR-884213: a certificate expired on the API gateway, we renewed it, permanent fix."
- "Add an RCA to the resolved Hyperdrive Failure incident: coolant leak in the motivator, replaced the seal, permanent fix."
- "We already resolved PagerDuty incident Q2X7PLM in Oppex. Attach this write-up as its RCA."
Who can use it
The same people who can resolve with an RCA.
Limits and errors
| Message | Meaning |
|---|---|
| "Provide either incidentId or externalId" | Neither ID was given. |
| "reasonForAlert is required", "actionTaken is required", "typeOfFix is required" | A required RCA field is missing. |
| "No incident found for the given incident ID" | No incident in your workspace has that Oppex ID. |
| "No incident found for the given external ID" | No incident in your workspace has that external ID. |
| "Multiple incidents match external ID '<id>'; use incidentId instead to disambiguate" | Several incidents share the external ID. Use the Oppex incident ID. |
| "Incident does not belong to caller's workspace" | The incident is in a different workspace from the one your connection uses. |
Grouped incidents
If the ID belongs to an incident that was grouped into another, the RCA is recorded on the incident it was grouped into.