Upload an attachment. POST /api/xm/1/attachments. Multipart file upload to temporary storage. Use the returned path when attaching to an event or scenario. File bytes are supplied by the MCP file input, not a filesystem path. Body fields: file, fileName. Reference: https://help.xmatters.com/xmapi/#upload-an-attachment Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get event audit information. GET /api/xm/1/audits. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-event-audit-information

Get changes. GET /api/xm/1/changes. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-changes

Get a change. GET /api/xm/1/changes/{changeID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-change

Create a change record. POST /api/xm/1/changes. Body fields: changeType, source, summary, changedAt, changedBy, details, externalIdentifier, service. Reference: https://help.xmatters.com/xmapi/#create-a-change-record Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get a device. GET /api/xm/1/devices/{deviceID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-device

Get devices. GET /api/xm/1/devices. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-devices

Create a device. POST /api/xm/1/devices. Device-type-specific fields are conditional. Mobile push devices cannot be created by REST; existing push devices can be modified. Body fields and nested structures remain open. Body fields: defaultDevice, delay, deviceType, id, externalKey, externallyOwned, name, owner, priorityThreshold, provider, recipientType, sequence, status, testStatus, timeframes, emailAddress, phoneNumber, twoWayDevice, pin, country. Reference: https://help.xmatters.com/xmapi/#create-a-device Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a device. POST /api/xm/1/devices. Other fields from Create a device and device objects may be supplied. Device-type-specific requirements are left to the API. Body fields: id, deviceType, privileged, defaultDevice, delay, externalKey, externallyOwned, name, owner, priorityThreshold, provider, recipientType, sequence, status, testStatus, timeframes, emailAddress, phoneNumber, twoWayDevice, pin, country. Reference: https://help.xmatters.com/xmapi/#modify-a-device Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a device. DELETE /api/xm/1/devices/{deviceID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-device Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get device names. GET /api/xm/1/device-names. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-device-names

Create a device name. POST /api/xm/1/device-names. The definition plus JavaScript/Python requests use /device-names. A cURL example uses deviceName; the definition is retained. See C12. Body fields: deviceType, name, description, privileged. Reference: https://help.xmatters.com/xmapi/#create-a-device-name Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a device name. POST /api/xm/1/device-names. Body fields: id, deviceType, name, description, privileged. Reference: https://help.xmatters.com/xmapi/#modify-a-device-name Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a device name. DELETE /api/xm/1/device-names/{deviceID}. DEFINITION incorrectly says /devices/{deviceID}; JavaScript and Python requests both use /device-names/{deviceID}. The cURL sample also misspells device-namess. See audited correction C01. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-device-name Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get device types. GET /api/xm/1/device-types. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-device-types

Get events. GET /api/xm/1/events. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-events

Get an event. GET /api/xm/1/events/{eventId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-an-event

Get event annotations. GET /api/xm/1/events/{eventID}/annotations. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-event-annotations

Get an event annotation. GET /api/xm/1/events/{eventID}/annotations/{annotationID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-an-event-annotation

Get an event attachment. GET /api/xm/1/events/{eventId}/attachments/{attachmentId}. Returns attachment bytes, including text files; response is not a JSON object despite illustrative response code. attachmentId is a file name. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-an-event-attachment

Get user delivery data. GET /api/xm/1/events/{eventID}/user-deliveries. Historical-data endpoint: at is required. Event identifier casing follows DEFINITION (eventID), not the table spelling eventId. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-user-delivery-data

Trigger an event. POST /api/integration/1/functions/{id}/triggers. Posts JSON to the configured integration function. The documented apiKey query authentication is not exposed as a model argument; use server-configured authentication. Tenant-defined custom trigger payloads remain open JSON. Body fields: attachments, bypassPhoneIntro, conference, escalationOverride, expirationInMinutes, otherResponseCountThreshold, overrideDeviceRestrictions, priority, properties, recipients, requirePhonePassword, responseOptions, senderOverrides, targetAllDevices, targetDeviceNames, voicemailOptions. Reference: https://help.xmatters.com/xmapi/#trigger-an-event Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Add a comment to an event. POST /api/xm/1/events/{eventId}/annotations. Body fields: comment. Reference: https://help.xmatters.com/xmapi/#add-a-comment-to-an-event Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Change the status of an event. POST /api/xm/1/events. Body fields: id, status. Reference: https://help.xmatters.com/xmapi/#change-the-status-of-an-event Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get suppressed events. GET /api/xm/1/event-suppressions. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-suppressed-events

Get conference bridges. GET /api/xm/1/conference-bridges. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-conference-bridges

Get a conference bridge. GET /api/xm/1/conference-bridges/{bridgeId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-conference-bridge

Create an external conference bridge. POST /api/xm/1/conference-bridges. Body fields: id, name, description, tollNumber, tollFreeNumber, preferredConnectionType, pauseBeforeBridgePrompt, staticBridgeNumber, bridgeNumber, meetingLink. Reference: https://help.xmatters.com/xmapi/#create-an-external-conference-bridge Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a conference bridge. POST /api/xm/1/conference-bridges. Body fields: id, name, description, tollNumber, tollFreeNumber, preferredConnectionType, pauseBeforeBridgePrompt, staticBridgeNumber, bridgeNumber, meetingLink. Reference: https://help.xmatters.com/xmapi/#modify-a-conference-bridge Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a conference bridge. DELETE /api/xm/1/conference-bridges/{bridgeID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-conference-bridge Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get forms. GET /api/xm/1/forms. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-forms

Get forms in a plan. GET /api/xm/1/plans/{planId}/forms. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-forms-in-a-plan

Get a form in a plan. GET /api/xm/1/forms/{formId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-form-in-a-plan

Get a form in a plan — sender permissions. GET /api/xm/1/forms/{formId}/sender-permissions. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-form-in-a-plan

Get a form in a plan — recipients. GET /api/xm/1/forms/{formId}/recipients. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-form-in-a-plan

Get a form in a plan — nested. GET /api/xm/1/plans/{planId}/forms/{formId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-form-in-a-plan

Get a form in a plan — nested recipients. GET /api/xm/1/plans/{planId}/forms/{formId}/recipients. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-form-in-a-plan

Get a form in a plan — nested sender permissions. GET /api/xm/1/plans/{planId}/forms/{formId}/sender-permissions. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-form-in-a-plan

Get form message templates. GET /api/xm/1/forms/{formId}/message-templates. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-form-message-templates

Get form response options. GET /api/xm/1/plans/{planId}/forms/{formId}/response-options. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-form-response-options

Get form response options — alias. GET /api/xm/1/forms/{formId}/response-options. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-form-response-options

Get form sections. GET /api/xm/1/forms/{formId}/sections. The reference labels embed/offset/limit as BODY PARAMETERS, but its GET definition and examples place embed in the query. These are query parameters; no GET body. See C05. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-form-sections

Create a plan form. POST /api/xm/1/plans/{planId}/forms. Body fields: name, description, triggerType, mobileEnabled, uiEnabled, apiEnabled. Reference: https://help.xmatters.com/xmapi/#create-a-plan-form Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Create form message templates. POST /api/xm/1/forms/{formId}/message-templates. Body fields: email, sms, voice. Reference: https://help.xmatters.com/xmapi/#create-form-message-templates Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Create form response options. POST /api/xm/1/forms/{formId}/response-options. Body fields: number, text, description, prompt, action, contribution, joinConference, allowComments, redirectUrl, translations. Reference: https://help.xmatters.com/xmapi/#create-form-response-options Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Create a form section. POST /api/xm/1/forms/{formId}/sections. Body is a form-section object; section-specific fields and Incident Details fields remain open. Only one section per request. Body fields: id, form, title, type, visible, collapsed, orderNum, bridgeType, properties, targetDeviceNames, otherResponseCountThreshold, priority, expiration, expirationInMinutes, overrideDeviceRestrictions, escalationOverride, bypassPhoneIntro, requirePhonePassword, voicemailOptions, recipients, enableResponseCount, responseCountThreshold, searchableTypes, expandableGroups, callerId, displayName. Reference: https://help.xmatters.com/xmapi/#create-a-form-section Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a plan form. POST /api/xm/1/plans/{planId}/forms. Body fields: id, name, description, triggerType, mobileEnabled, uiEnabled, apiEnabled. Reference: https://help.xmatters.com/xmapi/#modify-a-plan-form Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a form message template. POST /api/xm/1/forms/{formId}/message-templates. Body fields: email, sms, voice. Reference: https://help.xmatters.com/xmapi/#modify-a-form-message-template Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a form response option. POST /api/xm/1/forms/{formId}/response-options. Body fields: id, number, text, description, prompt, action, contribution, joinConference, allowComments, redirectUrl, translations. Reference: https://help.xmatters.com/xmapi/#modify-a-form-response-option Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a form section. POST /api/xm/1/forms/{formId}/sections. Body is a form-section object; section-specific fields remain open. Only one section per request; type cannot be modified. Body fields: id, form, title, type, visible, collapsed, orderNum, bridgeType, properties, targetDeviceNames, otherResponseCountThreshold, priority, expiration, expirationInMinutes, overrideDeviceRestrictions, escalationOverride, bypassPhoneIntro, requirePhonePassword, voicemailOptions, recipients, enableResponseCount, responseCountThreshold, searchableTypes, expandableGroups, callerId, displayName. Reference: https://help.xmatters.com/xmapi/#modify-a-form-section Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Update form recipients. PUT /api/xm/1/forms/{formId}/recipients. The request supports a top-level JSON array; listed body fields describe array entries, not mandatory root object keys. PUT is preserved from DEFINITION even where a Python sample incorrectly calls requests.post. Preserve any existing entries that should not be replaced; consult the official operation. Body fields: recipients. Reference: https://help.xmatters.com/xmapi/#update-form-recipients Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Update form recipients — nested. PUT /api/xm/1/plans/{planId}/forms/{formId}/recipients. The request supports a top-level JSON array; listed body fields describe array entries, not mandatory root object keys. PUT is preserved from DEFINITION even where a Python sample incorrectly calls requests.post. Preserve any existing entries that should not be replaced; consult the official operation. Body fields: recipients. Reference: https://help.xmatters.com/xmapi/#update-form-recipients Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Update sender permissions. PUT /api/xm/1/forms/{formId}/sender-permissions. The request supports a top-level JSON array; listed body fields describe array entries, not mandatory root object keys. PUT is preserved from DEFINITION even where a Python sample incorrectly calls requests.post. Preserve any existing entries that should not be replaced; consult the official operation. Body fields: senderType, sender, manageScenarios. Reference: https://help.xmatters.com/xmapi/#update-sender-permissions Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Update sender permissions — nested. PUT /api/xm/1/plans/{planId}/forms/{formId}/sender-permissions. The request supports a top-level JSON array; listed body fields describe array entries, not mandatory root object keys. PUT is preserved from DEFINITION even where a Python sample incorrectly calls requests.post. Preserve any existing entries that should not be replaced; consult the official operation. Body fields: senderType, sender, manageScenarios. Reference: https://help.xmatters.com/xmapi/#update-sender-permissions Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get group members. GET /api/xm/1/groups/{groupID}/members. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-group-members

Add a member to the group. POST /api/xm/1/groups/{groupID}/members. Body fields: id, recipientType. Reference: https://help.xmatters.com/xmapi/#add-a-member-to-the-group Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Remove a member from the group. DELETE /api/xm/1/groups/{groupID}/members/{memberID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#remove-a-member-from-the-group Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get a group. GET /api/xm/1/groups/{groupId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-group

Get groups. GET /api/xm/1/groups. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-groups

Create a group. POST /api/xm/1/groups. Body fields: allowDuplicates, description, externalKey, externallyOwned, groupType, observedByAll, observers, properties, recipientType, id, site, status, supervisors, targetName, useDefaultDevices, criteria. Reference: https://help.xmatters.com/xmapi/#create-a-group Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a group. POST /api/xm/1/groups. Body fields: id, allowDuplicates, description, externalKey, externallyOwned, groupType, observedByAll, observers, properties, recipientType, site, status, supervisors, targetName, useDefaultDevices, criteria. Reference: https://help.xmatters.com/xmapi/#modify-a-group Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a group. DELETE /api/xm/1/groups/{groupID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-group Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get a group's supervisors. GET /api/xm/1/groups/{groupId}/supervisors. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-group-39-s-supervisors

Get group license quotas. GET /api/xm/1/groups/license-quotas. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-group-license-quotas

Get a group's recipients. GET /api/xm/1/groups/{groupId}/recipients. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-group-39-s-recipients

Get import jobs. GET /api/xm/1/imports. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-import-jobs

Get an import job. GET /api/xm/1/imports/{importId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-an-import-job

Get import job messages. GET /api/xm/1/imports/{importId}/import-messages. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-import-job-messages

Get incidents. GET /api/xm/1/incidents. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-incidents

Get an incident. GET /api/xm/1/incidents/{incidentID}. Both UUID and incidentIdentifier are documented path alternatives despite their QUERY PARAMETERS heading. No identifier query is generated. See C06. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-an-incident

Get an incident — by identifier. GET /api/xm/1/incidents/{incidentIdentifier}. Both UUID and incidentIdentifier are documented path alternatives despite their QUERY PARAMETERS heading. No identifier query is generated. See C06. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-an-incident

Trigger an incident. POST /api/integration/1/functions/{id}/triggers. Posts JSON to the configured integration function. The documented apiKey query authentication is not exposed as a model argument; use server-configured authentication. Tenant-defined custom trigger payloads remain open JSON. Body fields: incidentDetails, recipients, properties, expirationInMinutes, overrideDeviceRestrictions, escalationOverride, bypassPhoneIntro, requirePhonePassword, voicemailOptions, senderOverrides, targetAllDevices, targetDeviceNames, priority. Reference: https://help.xmatters.com/xmapi/#trigger-an-incident Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Create an incident. POST /api/xm/1/incidents. Body fields: summary, description, severity, status. Reference: https://help.xmatters.com/xmapi/#create-an-incident Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify an incident. POST /api/xm/1/incidents. The reference documents both id and incidentIdentifier for lookup. Do not require both. JSON remains open. Body fields: id, incidentIdentifier, summary, description, severity, status. Reference: https://help.xmatters.com/xmapi/#modify-an-incident Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Add a timeline note. POST /api/xm/1/incidents/{incidentID}/timeline-entries. Body fields: entryType, text. Reference: https://help.xmatters.com/xmapi/#add-a-timeline-note Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get an integration. GET /api/xm/1/plans/{planId}/integrations/{integrationId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-an-integration

Get integrations. GET /api/xm/1/plans/{planId}/integrations. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-integrations

Get integration logs. GET /api/xm/1/integrations/{integrationId}/logs. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-integration-logs

Create an integration. POST /api/xm/1/plans/{planId}/integrations. Body fields: form, name, integrationType, environment, operation, triggeredBy, authenticationType, createdBy, deployed, script, endpoint, integrationService. Reference: https://help.xmatters.com/xmapi/#create-an-integration Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify an Integration. POST /api/xm/1/plans/{planId}/integrations. Body fields: id, form, name, integrationType, environment, operation, triggeredBy, authenticationType, createdBy, deployed, script, endpoint, integrationService. Reference: https://help.xmatters.com/xmapi/#modify-an-integration Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete an integration. DELETE /api/xm/1/plans/{planId}/integrations/{integrationId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-an-integration Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Obtain an access token and refresh token. POST /api/xm/1/oauth2/token. Uses application/x-www-form-urlencoded as in the official cURL --data example, not query credentials from the Python example. grant_type, client_id, username and password come only from server configuration. See C14. Body fields: none. Reference: https://help.xmatters.com/xmapi/#obtain-an-access-token-and-refresh-token Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Refresh an access token. POST /api/xm/1/oauth2/token. Uses application/x-www-form-urlencoded as in the official cURL --data example. grant_type, client_id and refresh_token come only from server configuration. See C14. Body fields: none. Reference: https://help.xmatters.com/xmapi/#refresh-an-access-token Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get who is on call. GET /api/xm/1/on-call. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-who-is-on-call

Get on-call summary. GET /api/xm/1/on-call-summary. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-on-call-summary

Get a person (by id). GET /api/xm/1/people/{personID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-person-by-id

Get people. GET /api/xm/1/people. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-people

Create a person. POST /api/xm/1/people. Body fields: externalKey, externallyOwned, firstName, id, language, lastName, licenseType, phoneLogin, phonePin, password, forcePasswordReset, properties, recipientType, roles, site, status, supervisors, targetName, timezone, webLogin. Reference: https://help.xmatters.com/xmapi/#create-a-person Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a person. POST /api/xm/1/people. Body fields: id, externalKey, externallyOwned, firstName, language, lastName, licenseType, phoneLogin, phonePin, password, forcePasswordReset, properties, recipientType, roles, site, status, supervisors, targetName, timezone, webLogin. Reference: https://help.xmatters.com/xmapi/#modify-a-person Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a person. DELETE /api/xm/1/people/{personID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-person Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get a person's devices. GET /api/xm/1/people/{personId}/devices. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-person-39-s-devices

Get a person's groups. GET /api/xm/1/people/{personID}/group-memberships. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-person-39-s-groups

Get a person's supervisors. GET /api/xm/1/people/{personId}/supervisors. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-person-39-s-supervisors

Get user license quotas. GET /api/xm/1/people/license-quotas. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-user-license-quotas

Get communication plans. GET /api/xm/1/plans. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-communication-plans

Get a communication plan. GET /api/xm/1/plans/{planId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-communication-plan

Create a communication plan. POST /api/xm/1/plans. Body fields: name, description, enabled, accessibleByAll, position. Reference: https://help.xmatters.com/xmapi/#create-a-communication-plan Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify communication plan. POST /api/xm/1/plans. Body fields: id, name, description, enabled, loggingLevel, accessibleByAll, position. Reference: https://help.xmatters.com/xmapi/#modify-communication-plan Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a plan. DELETE /api/xm/1/plans/{planId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-plan Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get plan constants. GET /api/xm/1/plans/{planId}/constants. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-plan-constants

Create a plan constant. POST /api/xm/1/plans/{planId}/constants. Body fields: name, value, description. Reference: https://help.xmatters.com/xmapi/#create-a-plan-constant Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a plan constant. POST /api/xm/1/plans/{planId}/constants. Body fields: id, name, value, description. Reference: https://help.xmatters.com/xmapi/#modify-a-plan-constant Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a plan constant. DELETE /api/xm/1/plans/{planId}/constants/{constantId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-plan-constant Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get plan endpoints. GET /api/xm/1/plans/{planId}/endpoints. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-plan-endpoints

Create plan endpoint. POST /api/xm/1/plans/{planId}/endpoints. Body fields: name, url, endpointType, authenticationType, authentication. Reference: https://help.xmatters.com/xmapi/#create-plan-endpoint Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a plan endpoint. POST /api/xm/1/plans/{planID}/endpoints. Examples identify the endpoint with body id and the plan in the path, but the body table lists plan and prose says plan UUID. Both id and plan are allowed without inventing a mandatory field. The JavaScript sample ednpoints typo is not adopted. See C09. Body fields: plan, name, url, endpointType, authenticationType, authentication, id. Reference: https://help.xmatters.com/xmapi/#modify-a-plan-endpoint Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a plan endpoint. DELETE /api/xm/1/plans/{planId}/endpoints/{endpointId}. DEFINITION uses singular endpoint; cURL, JavaScript, Python and the returned self link agree on plural endpoints. See C02. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-plan-endpoint Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get plan properties. GET /api/xm/1/plans/{planId}/property-definitions. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-plan-properties

Create plan properties. POST /api/xm/1/plans/{planId}/property-definitions. planId is the required path identifier despite the BODY PARAMETERS heading. Property type-specific fields come from Plan Property Objects; JSON remains open. See C07. Body fields: id, propertyType, name, description, helpText, default, delimiter, categories, paths, items, maxLength, minLength, units, pattern, validate. Reference: https://help.xmatters.com/xmapi/#create-plan-properties Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify plan properties. POST /api/xm/1/plans/{planId}/property-definitions. Body fields: id, propertyType, name, description, helpText, default, delimiter, categories, paths, items, maxLength, minLength, units, pattern, validate. Reference: https://help.xmatters.com/xmapi/#modify-plan-properties Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get roles. GET /api/xm/1/roles. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-roles

Get scenarios. GET /api/xm/1/scenarios. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-scenarios

Get a scenario. GET /api/xm/1/scenarios/{scenarioId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-scenario

Get scenarios in a form. GET /api/xm/1/plans/{planId}/forms/{formId}/scenarios. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-scenarios-in-a-form

Get a scenario attachment. GET /api/xm/1/scenarios/{scenarioId}/attachments/{attachmentId}. Returns attachment bytes, including text files; response is not a JSON object despite illustrative response code. attachmentId is a file name. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-scenario-attachment

Get scenario sender permissions. GET /api/xm/1/scenarios/{scenarioId}/sender-permissions. The table calls the scenario path identifier id and labels it QUERY PARAMETERS; the definition uses scenarioId in the path. See C06. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-scenario-sender-permissions

Create a scenario. POST /api/xm/1/forms/{formId}/scenarios. Body fields: attachments, bypassPhoneIntro, description, escalationOverride, expirationInMinutes, name, overrideDeviceRestrictions, permitted, priority, properties, recipients, requirePhonePassword, senderOverrides, targetDeviceNames, voicemailOptions. Reference: https://help.xmatters.com/xmapi/#create-a-scenario Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a scenario. POST /api/xm/1/forms/{formId}/scenarios. Body fields: id, attachments, bypassPhoneIntro, description, escalationOverride, expirationInMinutes, name, overrideDeviceRestrictions, permitted, priority, properties, recipients, requirePhonePassword, senderOverrides, targetDeviceNames, voicemailOptions. Reference: https://help.xmatters.com/xmapi/#modify-a-scenario Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Upload attachment to a scenario. POST /api/xm/1/forms/{formId}/scenarios/{scenarioId}/attachments. Multipart file upload. The reference says multi-part/form in examples; use standard multipart/form-data as documented for the equivalent attachment upload. File bytes are supplied by the MCP file input, not a filesystem path. See C13. Body fields: file, fileName. Reference: https://help.xmatters.com/xmapi/#upload-attachment-to-a-scenario Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Set scenario sender permissions. PUT /api/xm/1/scenarios/{scenarioId}/sender-permissions. The request supports a top-level JSON array; listed body fields describe array entries, not mandatory root object keys. PUT is preserved from DEFINITION even where a Python sample incorrectly calls requests.post. Preserve any existing entries that should not be replaced; consult the official operation. Body fields: senderType, sender, editScenarios. Reference: https://help.xmatters.com/xmapi/#set-scenario-sender-permissions Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get scheduled messages. GET /api/xm/1/scheduled-messages. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-scheduled-messages

Get a scheduled message. GET /api/xm/1/scheduled-messages/{scheduledMessageId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-scheduled-message

Get a scheduled message attachment. GET /api/xm/1/scheduled-messages/{scheduledMessageId}/attachments/{attachmentId}. Returns attachment bytes, including text files; response is not a JSON object despite illustrative response code. attachmentId is a file name. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-scheduled-message-attachment

Create a scheduled message. POST /api/xm/1/scheduled-messages. Nested event and recurrence objects remain open; consult the Scheduled Message and MessageRecurrence objects. Body fields: name, event, attachments, recurrence. Reference: https://help.xmatters.com/xmapi/#create-a-scheduled-message Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a scheduled message. POST /api/xm/1/scheduled-messages. Body fields: id, name, event, attachments, recurrence. Reference: https://help.xmatters.com/xmapi/#modify-a-scheduled-message Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a scheduled message. DELETE /api/xm/1/scheduled-messages/{scheduledMessageId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-scheduled-message Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get service dependencies. GET /api/xm/1/service-dependencies. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-service-dependencies

Create a service dependency. POST /api/xm/1/service-dependencies. Body fields: serviceId, dependentServiceId. Reference: https://help.xmatters.com/xmapi/#create-a-service-dependency Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a service dependency. POST /api/xm/1/service-dependencies. Body fields: id, serviceId, dependentServiceId. Reference: https://help.xmatters.com/xmapi/#modify-a-service-dependency Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a service dependency. DELETE /api/xm/1/service-dependencies/{id}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-service-dependency Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get services. GET /api/xm/1/services. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-services

Get a service. GET /api/xm/1/services/{serviceId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-service

Create a service. POST /api/xm/1/services. Body fields: targetName, description, serviceTier, serviceType, ownedBy. Reference: https://help.xmatters.com/xmapi/#create-a-service Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a service. POST /api/xm/1/services. Body fields: id, targetName, description, serviceTier, serviceType, ownedBy. Reference: https://help.xmatters.com/xmapi/#modify-a-service Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a service. DELETE /api/xm/1/services/{serviceId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-service Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get shared libraries. GET /api/xm/1/plans/{planId}/shared-libraries. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-shared-libraries

Get a shared library. GET /api/xm/1/shared-libraries/{libraryId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-shared-library

Create a shared library. POST /api/xm/1/shared-libraries. Body fields: name, script, plan. Reference: https://help.xmatters.com/xmapi/#create-a-shared-library Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a shared library. POST /api/xm/1/shared-libraries. Body fields: id, name, script. Reference: https://help.xmatters.com/xmapi/#modify-a-shared-library Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a shared library. DELETE /api/xm/1/shared-libraries/{libraryID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-shared-library Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get a shift. GET /api/xm/1/groups/{groupID}/shifts/{shiftID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-shift

Get shifts. GET /api/xm/1/groups/{groupID}/shifts. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-shifts

Get members in a shift. GET /api/xm/1/groups/{groupID}/shifts/{shiftID}/members. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-members-in-a-shift

Get shift occurrences. GET /api/xm/1/groups/{groupId}/occurrences. The last definition example has /occurrences/shifts=...; shifts is a query parameter, not a path component. The shared URL PARAMETERS table includes both path and query parameters. See C03. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-shift-occurrences

Get deleted shift occurrences. GET /api/xm/1/groups/{groupID}/shifts/{shiftID}/exclusions. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-deleted-shift-occurrences

Create a shift. POST /api/xm/1/groups/{groupID}/shifts/. The definition omits its initial slash; the standard base URL and request examples establish the full root path. Its trailing slash is preserved. Name is required; start/end and recurrence fields are conditional. See C04. Body fields: name, description, recurrence, members, siteHolidays, timezone, start, end, rotation, repeatEscalation, notifyEndofEscalation, notifyEndOfEscalation. Reference: https://help.xmatters.com/xmapi/#create-a-shift Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Update a shift. POST /api/xm/1/groups/{groupID}/shifts. The definition uses the collection path; cURL/Python additionally show a path-addressed shift variant, separately cataloged. Examples submit body id while the table says shiftID; both are informational, not forced. See C08. Body fields: shiftID, name, description, recurrence, members, siteHolidays, timezone, start, end, rotation, repeatEscalation, notifyEndofEscalation, id, notifyEndOfEscalation. Reference: https://help.xmatters.com/xmapi/#update-a-shift Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Add a member to a shift. POST /api/xm/1/groups/{groupID}/shifts/{shiftID}/members. Body fields: recipient, position, delay, escalationType, inRotation, onDuty. Reference: https://help.xmatters.com/xmapi/#add-a-member-to-a-shift Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a shift. DELETE /api/xm/1/groups/{groupID}/shifts/{shiftID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-shift Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Restore deleted shift occurrences. POST /api/xm/1/groups/{groupID}/shifts/{shiftID}/occurrences. The definition and cURL request use /occurrences; a sample response self link says exclusionss and is not adopted. See C11. Body fields: startDate, endDate. Reference: https://help.xmatters.com/xmapi/#restore-deleted-shift-occurrences Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get signals. GET /api/xm/1/signals. The definition and returned collection self link use /signals. The cURL and JavaScript examples incorrectly use /groups/IT/signals; that path is not presented as a separate operation. See C10. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-signals

Get a signal. GET /api/xm/1/signals/{signalID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-signal

Get a site. GET /api/xm/1/sites/{siteID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-site

Get sites. GET /api/xm/1/sites. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-sites

Create a site. POST /api/xm/1/sites. Body fields: name, country, language, timezone. Reference: https://help.xmatters.com/xmapi/#create-a-site Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a site. POST /api/xm/1/sites/. The trailing slash is preserved from DEFINITION (/sites/); prose and request examples also use /sites. They describe the same operation. Body fields: id, name, country, language, timezone, address1, address2, city, externalKey, externallyOwned, latitude, longitude, postalCode, state, status. Reference: https://help.xmatters.com/xmapi/#modify-a-site Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a site. DELETE /api/xm/1/sites/{siteID}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-site Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get a subscription form. GET /api/xm/1/subscription-forms/{subscriptionFormId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-subscription-form

Get subscription forms. GET /api/xm/1/subscription-forms. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-subscription-forms

Get subscription forms in a plan. GET /api/xm/1/plans/{planId}/subscription-forms. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-subscription-forms-in-a-plan

Create a subscription form. POST /api/xm/1/plans/{planId}/subscription-forms. Body fields: name, description, scope, form, oneWay, subscribeOthers, notificationDelay, propertyDefinitions, roles, devicesSectionCollapsed, devicesSectionVisible, targetDeviceNames. Reference: https://help.xmatters.com/xmapi/#create-a-subscription-form Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a subscription form. POST /api/xm/1/plans/{planId}/subscription-forms. Body fields: id, name, description, scope, form, oneWay, subscribeOthers, notificationDelay, propertyDefinitions, roles, devicesSectionCollapsed, devicesSectionVisible, targetDeviceNames. Reference: https://help.xmatters.com/xmapi/#modify-a-subscription-form Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get subscriptions. GET /api/xm/1/subscriptions. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-subscriptions

Get a subscription. GET /api/xm/1/subscriptions/{subscriptionId}. The table calls the subscription path identifier id and labels it QUERY PARAMETERS; the definition uses subscriptionId in the path. See C06. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-a-subscription

Get subscribers. GET /api/xm/1/subscriptions/{subscriptionId}/subscribers. The table calls the subscription path identifier id and labels it QUERY PARAMETERS; offset/limit are query parameters, subscriptionId is a path parameter. See C06. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-subscribers

Get subscription share permissions. GET /api/xm/1/subscriptions/{subscriptionId}/share-permissions. The table calls the subscription path identifier id and labels it QUERY PARAMETERS; the definition uses subscriptionId in the path. See C06. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-subscription-share-permissions

Create a subscription. POST /api/xm/1/subscriptions. Body fields: name, description, form, owner, notificationDelay, criteria, recipients, targetDeviceNames. Reference: https://help.xmatters.com/xmapi/#create-a-subscription Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Modify a subscription. POST /api/xm/1/subscriptions. Include id and changed fields. The reference explicitly disallows changing form on an existing subscription. Body fields: id, name, description, owner, notificationDelay, criteria, recipients, targetAllDevices, targetDeviceNames. Reference: https://help.xmatters.com/xmapi/#modify-a-subscription Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Add subscribers. PUT /api/xm/1/subscriptions/{subscriptionId}/subscribers. The request supports a top-level JSON array; listed body fields describe array entries, not mandatory root object keys. PUT is preserved from DEFINITION even where a Python sample incorrectly calls requests.post. Preserve any existing entries that should not be replaced; consult the official operation. Body fields: recipients. Reference: https://help.xmatters.com/xmapi/#add-subscribers Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Set subscription share permissions. PUT /api/xm/1/subscriptions/{subscriptionId}/share-permissions. The request supports a top-level JSON array; listed body fields describe array entries, not mandatory root object keys. PUT is preserved from DEFINITION even where a Python sample incorrectly calls requests.post. Preserve any existing entries that should not be replaced; consult the official operation. Body fields: shareType, sharedWith, permissibleActions. Reference: https://help.xmatters.com/xmapi/#set-subscription-share-permissions Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a subscription. DELETE /api/xm/1/subscriptions/{subscriptionId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-subscription Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Unsubscribe a user. DELETE /api/xm/1/subscriptions/{subscriptionId}/subscribers/{personId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#unsubscribe-a-user Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Get temporary absences. GET /api/xm/1/temporary-absences. Body fields: none. Reference: https://help.xmatters.com/xmapi/#get-temporary-absences

Create a temporary absence. POST /api/xm/1/temporary-absences. replacement is conditional on absenceType=REPLACEMENT and tenant policy; not required globally. Body fields: id, absenceType, member, start, end, group, includeDirectNotifications, replacement. Reference: https://help.xmatters.com/xmapi/#create-a-temporary-absence Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Delete a temporary absence. DELETE /api/xm/1/temporary-absences/{temporaryAbsenceId}. Body fields: none. Reference: https://help.xmatters.com/xmapi/#delete-a-temporary-absence Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Upload a User Upload file. POST /api/xm/1/uploads/users-v1. Multipart CSV User Upload v1.5. File bytes are supplied by the MCP file input; optional body name labels the import job. Body fields: file, name. Reference: https://help.xmatters.com/xmapi/#upload-a-user-upload-file Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Upload an EPIC ZipSync file. POST /api/xm/1/uploads/epic-v1. Multipart ZipSync v1.3 upload (upstream maximum 150 MB; the server may impose a smaller configured limit). File bytes are supplied by the MCP file input. Body fields: file. Reference: https://help.xmatters.com/xmapi/#upload-an-epic-zipsync-file Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Trigger an incident — Flow Trigger form. POST /api/xm/1/forms/{formId}/triggers. Additional path from the official cURL and JavaScript examples; DEFINITION instead describes the custom HTTP Request integration trigger. The Python sample omits /xm/1, so it is not followed. JSON remains open. Body fields: incidentDetails, recipients, properties, expirationInMinutes, overrideDeviceRestrictions, escalationOverride, bypassPhoneIntro, requirePhonePassword, voicemailOptions, senderOverrides, targetAllDevices, targetDeviceNames, priority. Reference: https://help.xmatters.com/xmapi/#trigger-an-incident Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.

Update a shift — path-addressed shift. POST /api/xm/1/groups/{groupID}/shifts/{shiftID}. Additional path from the official cURL and Python POST examples. DEFINITION and JavaScript use the collection path. Both are retained as separately named documented variants; tenant execution of the example-only variant is unverified. Examples use body id; the parameter table calls it shiftID. Body fields: shiftID, name, description, recurrence, members, siteHolidays, timezone, start, end, rotation, repeatEscalation, notifyEndofEscalation, id, notifyEndOfEscalation. Reference: https://help.xmatters.com/xmapi/#update-a-shift Requires operator write opt-in and confirm:true; may notify recipients or change tenant data.