Export incident evidence
A hashed and signed record of the incident: detection time, classification, affected services, customers and locations, duration, the public update timeline, notification receipts (recipients minimised), related changes and the postmortem link. Verify it at the verify_url in the envelope. Available on the Business plan and above. Every export is recorded in the audit log.
Authorizations
An organization API key (obs_pub_…) sent as Authorization: Bearer <key>. Each key carries scopes; an endpoint lists the scope it needs.
Path Parameters
Incident id.
Query Parameters
json (default) or pdf. Agents and MCP clients should use json; pdf is for downloading the document directly.
json, pdf Response
ok. The JSON envelope holds payload, sha256, signature, signing_key_id and verify_url; with format=pdf the body is the rendered PDF.
The response is of type object.

