swsd_sla_risk
Rank open incidents by SLA breach risk using due dates and violations to flag breached, critical, warning, or OK work so teams prioritize at-risk tickets.
Instructions
List open incidents ranked by SLA breach risk. Computes a risk level for each incident based on due_at and sla_violations: "breached" (overdue or has violations), "critical" (due within 4 hours), "warning" (due within at_risk_within_hours), "ok", or "no_due_date". Results are sorted with breached first (most overdue first), then by time-to-breach ascending, no_due_date last. Defaults to excluding Resolved and Closed states. Limitation: incident list rows only normally include due_at. The sla_violations[] array is only present on the long incident layout, so rows are ranked primarily by due_at and violations are counted only when SWSD happens to include them on the row. Use swsd_get_incident with detail_level long for a complete per-incident SLA picture.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number (1-indexed). | |
| states | No | Filter to incidents matching ANY of these states. | |
| per_page | No | Results per page (1-100). SWSD caps at 100. | |
| priorities | No | Filter to incidents matching ANY of these priorities. | |
| max_results | No | Cap returned incidents while scanning up to 10 pages from page (also bounded by page 10000). Stops when enough matches are found; ranks the scanned matches only. scan.truncated reports omitted matches or remaining pages. Without this option, scans one page. | |
| state_is_not | No | Negative state filter. Defaults to excluding Resolved and Closed. | |
| updated_from | No | Filter to incidents updated on or after this ISO date or datetime. | |
| assignee_email | No | Client-side case-insensitive filter on assignee email (SWSD ignores it server-side). | |
| updated_within | No | Convenience alias for updated_from: "Nh" is an exact hours-ago ISO timestamp; "Nd" and "Nw" use the UTC calendar date N days or N weeks ago. N must be 1-365. Ignored if updated_from is explicitly set. | |
| assigned_to_group | No | Filter to incidents assigned to this group ID (server-side). | |
| include_no_due_date | No | Include incidents with no due_at in results. Default false. | |
| at_risk_within_hours | No | Hours threshold for "warning" risk bucket. Default 24, max 720 (30 days). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| now | Yes | ISO timestamp used as the reference clock for risk computation. | |
| scan | Yes | ||
| counts | Yes | Count of incidents per risk level. | |
| incidents | Yes | ||
| pagination | Yes | ||
| applied_filters | Yes |