Incident Library

Returns one case in full by its id: the structured write-up (symptoms, trigger, root cause, components, contributing factors, summary, impact, timeline, detection, remediation, action items, lessons), its sources with archived copies, and similar_cases. Use after search_incidents, list_incidents or get_topic has given you a case id; not for finding cases (use search_incidents for symptoms, list_incidents or get_topic for a category). lang: ko returns the Korean text of each field where the reviewers wrote one, otherwise English. The id must look like IL-0007; an id of that shape that matches no approved case returns an error result saying so, and an id of another shape is rejected before the call. Every call for the same id returns the same case.

Returns one vocabulary value with every case that carries it and, under related, the other four kinds counted over those cases with case ids: for a symptom, the root causes behind it (answers 'what usually causes this'); for a root cause, the components and factors seen with it. Use when you already have a slug and want the picture around it; use vocab to find the slug from words, list_incidents for a plain paged list, search_incidents for a symptom sentence. kind is the slug's category: root_causes, components, symptoms, factors or orgs (the organisations that published cases). With symptoms, the page keeps only the cases that sentence finds, best match first, and query echoes it, so 'certificate expiry, but only where DNS was involved' is one call. The answer is not paged: count and cases hold every case of the value (at most a few dozen today). An unknown slug or a slug of the wrong kind returns an error result naming it; nothing is written.

Lists cases by category, newest first, one page at a time: count and cases (id, title, organisation, date, root cause, page url), plus next_cursor when more remain; call again with cursor for the following page. Use when the question names a category (a root cause, component, symptom, contributing factor, domain or organisation) rather than a symptom sentence; for a sentence use search_incidents, and for one category with its related categories counted use get_topic. Each filter is a slug (kebab-case) of its own kind: symptom is what was observed (pod-pending), factor is a condition that made it worse (no-alerting), root_cause is why it happened (capacity). Filters combine with AND. An unknown slug returns count 0 with no error; find the slug with vocab when you only have words. Reads only; the same filters return the same page.

Use first, whenever someone describes a failure they are seeing. Pass the symptoms as a sentence or a few words, in English or Korean; returns every reviewed public post-incident report the search finds for it, best match first: total is how many, results is one page of them in full (each with the case id, the page url and the source link), matched is every one as a row, and next_cursor fetches the next page. interpreted lists the values the sentence named, organisations included (the search moves cases carrying them up); facets count the results by root cause, component, symptom, contributing factor and organisation with the case ids, which answers 'what usually caused this' from the same call. The optional slug filters keep only cases carrying those values (AND); take slugs from facets, interpreted or vocab. Follow with get_incident for the full case.

Resolves words to vocabulary slugs for the filters of search_incidents, list_incidents and get_topic. With query, returns matches: the limit values nearest in meaning to the words, nearest first, each with kind, slug, English and Korean name and page url (e.g. 'cert ran out' finds certificate-expiry); kind restricts to one category. There is no similarity cutoff: the list is always limit long, so when the words name nothing in the library the matches are far from them; read the names before using a slug, and when none fits, search with search_incidents instead of filtering. Without query, returns every value of every kind with names, aliases and definitions (a large answer; prefer query). Reads only.