Everything an AI agent can do with the Opsgenie API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints34
API versionv2
Last updated23 June 2026
Orientation

How the Opsgenie API works.

The Opsgenie API is how an app or AI agent works with an Opsgenie account: raising and closing alerts, acknowledging and assigning them, opening incidents, reading who is on call right now, and pinging heartbeats. Access is granted through an API key created on an integration, and that key carries broad access rights, read, create and update, delete, and configuration, rather than a permission per method, so a key can reach a whole area or nothing of it. Opsgenie can also forward events to an app as they happen, set up through an integration.

34Endpoints
9Capability groups
16Read
18Write
4Permissions
Authentication
Every request sends an API key in an Authorization header as 'GenieKey '. The key is created on an API integration in Opsgenie, not minted per user, and the integration it belongs to can be scoped to a single team. There are no granular per-endpoint OAuth scopes: what a key can do is set by the access-right toggles on it, not by the individual method.
Permissions
An API key carries four broad access rights rather than a permission per method: Read Access for retrieving data, Create and Update Access for raising and changing entities, Delete Access for removing them, and Configuration Access for the configuration areas such as users, teams, schedules, escalations, integrations, and policies. Turning off Configuration Access blocks every one of those areas at once. Because the access is by area and not by method, the closest thing to a per-method capability is the access right that gates it, or none where read is open to any valid key.
Versioning
The current REST API is version 2, reached through a v2 path segment, with some endpoints such as incidents still served under v1. There is no dated version header to pin, so an integration moves with the live API. Atlassian stopped selling Opsgenie on 4 June 2025 and has set end of support for 5 April 2027, after which the product shuts down and unmigrated data is deleted.
Data model
The API is resource-oriented JSON over HTTPS, at api.opsgenie.com for most accounts and api.eu.opsgenie.com for accounts hosted in the EU. Most write actions are processed asynchronously: the call returns 202 Accepted with a requestId, and the result is checked afterwards on a request-status endpoint. An alert is the core resource, identified by id, alias, or a short tinyId, and an incident groups the response to a wider outage.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Opsgenie determines what it can reach. Access runs through an API key created on an integration, and the access rights set on that key and integration decide what it can do.

Ways to connect

REST API

The REST API answers at api.opsgenie.com, or api.eu.opsgenie.com for EU-hosted accounts, under a v2 path segment with a few areas still on v1. It authenticates with a GenieKey API key, and most write actions return 202 Accepted and complete asynchronously.

Best forConnecting an app or AI agent to Opsgenie.
Governed byThe API key and the access rights set on it and its integration.
Docs ↗

Integrations (inbound and outbound)

Integrations are the configured connections that feed events into Opsgenie and forward them out. An inbound integration receives alerts from a monitoring tool, and an outbound one forwards Opsgenie events to another system. The API key an agent uses is itself created on an API integration.

Best forReceiving events from Opsgenie without polling.
Governed byThe integration's configuration and team scope.
Docs ↗
Authentication

API integration key (GenieKey)

An API key is created on an API integration in Opsgenie and sent in the Authorization header as 'GenieKey '. The key carries the four access-right toggles, and the integration it belongs to can be limited to a single team, which is the main way to narrow what the key reaches.

TokenAPI integration key
Best forServer-to-server and agent access
Docs ↗

Basic authentication

The same API key can be sent using HTTP Basic authentication, as the password with an empty username, base64-encoded. It carries the identical access rights as the GenieKey header, and is offered for clients that send Basic credentials more easily.

TokenAPI integration key
Best forClients that send Basic auth
Docs ↗
Capability map

What an AI agent can do in Opsgenie.

The Opsgenie API is split into areas an agent can act on, such as alerts, incidents, on-call schedules, escalations, teams, and heartbeats. Each area has its own methods, and writes here page real people and change who gets notified when something breaks.

Alerts

11 endpoints

Create, read, list, and delete alerts, and acknowledge, close, snooze, escalate, assign, and add notes to them.

Writes here page real people and change the state of live alerts.
View endpoints

Incidents

4 endpoints

Create, read, and list incidents, and close them. Incident endpoints are served under a v1 path segment.

Writes here open or close real incidents and notify responders.
View endpoints

Schedules & on-call

4 endpoints

Read, list, and change on-call schedules, and read who is on call now and who is on call next.

Writes here change who is on call and gets paged.
View endpoints

Escalations

2 endpoints

Read, list, create, and update escalation chains that decide who is notified next when an alert is not handled.

Writes here change how unhandled alerts are routed.
View endpoints

Teams

2 endpoints

Read, list, create, and update the teams that own alerts and schedules.

Writes here change team membership and ownership.
View endpoints

Users

3 endpoints

Read, list, create, update, and delete the people in the account.

Writes here add, change, or remove real people.
View endpoints

Integrations

2 endpoints

List integrations, read one, and enable or disable an integration that feeds or forwards events.

Writes here turn event sources on or off.
View endpoints

Heartbeats

3 endpoints

Ping a heartbeat to signal a system is alive, list heartbeats, and read one.

Writes here change whether a missed signal raises an alert.
View endpoints

Policies

3 endpoints

List, read, create, and update alert and notification policies that filter and shape alerts.

Writes here change which alerts fire and how they notify.
View endpoints
Endpoint reference

Every Opsgenie API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Alerts

Create, read, list, and delete alerts, and acknowledge, close, snooze, escalate, assign, and add notes to them.11

Processed asynchronously: returns 202 Accepted with a requestId. Needs the Create and Update access right on the key.

Acts onalert
Permission (capability)Create and Update
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Falls in the Search rate-limit domain. limit defaults to 20 and maxes at 100.

Acts onalert
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Returns a count rather than the alerts themselves.

Acts onalert
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Set identifierType to id, alias, or tiny to choose how the identifier is read.

Acts onalert
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Processed asynchronously: returns 202 Accepted with a requestId. Needs the Delete access right on the key.

Acts onalert
Permission (capability)Delete
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Processed asynchronously: returns 202 Accepted with a requestId.

Acts onalert
Permission (capability)Create and Update
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Processed asynchronously: returns 202 Accepted with a requestId.

Acts onalert
Permission (capability)Create and Update
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

The endTime field sets when the alert wakes again. Processed asynchronously.

Acts onalert
Permission (capability)Create and Update
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Routes the alert to the named escalation. Processed asynchronously.

Acts onalert
Permission (capability)Create and Update
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

The owner field names the user the alert is assigned to. Processed asynchronously.

Acts onalert
Permission (capability)Create and Update
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Processed asynchronously: returns 202 Accepted with a requestId.

Acts onalert
Permission (capability)Create and Update
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Incidents

Create, read, and list incidents, and close them. Incident endpoints are served under a v1 path segment.4

Incident endpoints are under v1. Processed asynchronously: returns 202 Accepted with a requestId.

Acts onincident
Permission (capability)Create and Update
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Incident endpoints are under v1.

Acts onincident
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Incident endpoints are under v1.

Acts onincident
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Incident endpoints are under v1. Processed asynchronously.

Acts onincident
Permission (capability)Create and Update
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Schedules & on-call

Read, list, and change on-call schedules, and read who is on call now and who is on call next.4

Reading the configuration areas needs Configuration Access on the key.

Acts onschedule
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Set identifierType to id or name. Reading the configuration areas needs Configuration Access.

Acts onschedule
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Falls in the Schedule-oncalls rate-limit domain.

Acts onon-call
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Falls in the Schedule-oncalls rate-limit domain.

Acts onon-call
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Escalations

Read, list, create, and update escalation chains that decide who is notified next when an alert is not handled.2

Reading the configuration areas needs Configuration Access on the key.

Acts onescalation
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Writing a configuration area needs both Create and Update and Configuration Access on the key.

Acts onescalation
Permission (capability)Configuration Access
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Teams

Read, list, create, and update the teams that own alerts and schedules.2

Reading the configuration areas needs Configuration Access on the key.

Acts onteam
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Writing a configuration area needs both Create and Update and Configuration Access on the key.

Acts onteam
Permission (capability)Configuration Access
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Users

Read, list, create, update, and delete the people in the account.3

Falls in the Search rate-limit domain. Reading the configuration areas needs Configuration Access.

Acts onuser
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Writing a configuration area needs both Create and Update and Configuration Access on the key.

Acts onuser
Permission (capability)Configuration Access
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Removing a person needs both Delete and Configuration Access on the key.

Acts onuser
Permission (capability)Delete
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Integrations

List integrations, read one, and enable or disable an integration that feeds or forwards events.2

Reading the configuration areas needs Configuration Access on the key.

Acts onintegration
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Turning an event source on or off needs both Create and Update and Configuration Access.

Acts onintegration
Permission (capability)Configuration Access
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Heartbeats

Ping a heartbeat to signal a system is alive, list heartbeats, and read one.3

Ping is accepted on GET, POST, PUT, or PATCH. Falls in the Heartbeat rate-limit domain.

Acts onheartbeat
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Reading the configuration areas needs Configuration Access on the key.

Acts onheartbeat
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Reading the configuration areas needs Configuration Access on the key.

Acts onheartbeat
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Policies

List, read, create, and update alert and notification policies that filter and shape alerts.3

Returns at most 1000 policies. Reading the configuration areas needs Configuration Access.

Acts onpolicy
Permission (capability)Read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Writing a configuration area needs both Create and Update and Configuration Access on the key.

Acts onpolicy
Permission (capability)Configuration Access
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

The targetIndex field sets the new position. Needs Create and Update and Configuration Access.

Acts onpolicy
Permission (capability)Configuration Access
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

Opsgenie can notify an app or AI agent when something happens to an alert, instead of the app repeatedly asking. Outbound notifications are configured as integrations rather than per-event webhook subscriptions through the API, so the events an integration forwards are set up in Opsgenie itself.

EventWhat it signalsTriggered by
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Opsgenie limits how fast an app or AI agent can call, through a token-bucket model applied separately to each group of endpoints, so heavy alert traffic does not starve configuration calls and the reverse.

Request rate

Opsgenie uses a token-bucket model where each request spends one token, tracked over both a per-second and a per-minute window. The limits are applied separately to each request domain, such as Alert, Incident, Heartbeat, Configuration (the team, user, escalation, schedule, integration, and policy areas), Search (listing alerts and users), and Schedule-oncalls, so spending one domain's budget does not affect another. Going over returns 429 Too Many Requests, and the response carries X-RateLimit-State (OK, BURST, or THROTTLED), X-RateLimit-Reason (ACCOUNT or INTEGRATION), and X-RateLimit-Period-In-Sec. Atlassian recommends exponential backoff, waiting 2^attemptCount times 200 milliseconds between retries.

Pagination

List endpoints use offset pagination through the offset parameter, which starts at 0, and the limit parameter, which defaults to 20 and tops out at 100. Results are ordered by the sort field, defaulting to createdAt, and the order parameter, defaulting to desc. List responses also return paging links for the next and previous pages where they apply.

Request size

Requests and responses are JSON. Listing endpoints return at most 100 items per page, and the alert policy list returns at most 1000 policies. Individual fields such as an alert message and description have their own length ceilings set per endpoint.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400Bad RequestThe request body is not valid, most often invalid JSON.Correct the request body so it is well-formed JSON and resend.
401UnauthenticatedThe API key is invalid or the integration it belongs to is disabled.Check the GenieKey value and the Authorization header, and confirm the integration is enabled and on the right regional host.
402Payment RequiredThe API key is valid, but the account's subscription plan does not allow this action.Upgrade the plan to one that includes the feature, or avoid the action.
403ForbiddenThe API key is valid but cannot perform this operation. Code 40301 means the key lacks the access right or permission for it; 40302 means the operation is not supported for this request.Grant the missing access right on the key, such as Create and Update, Delete, or Configuration Access, or use a key from an API integration.
404Not FoundThe resource or handler does not exist, or the key's integration cannot see it.Confirm the identifier and identifierType, and that the integration is scoped to reach the resource.
409ConflictThe id or name conflicts with another entity that already exists.Use a unique name or identifier, or update the existing entity instead.
422Unprocessable EntityThe request is well-formed but has semantic errors in the body, such as a field that fails validation.Read the message field, correct the named field, and resend.
429Too Many RequestsA rate limit for the request's domain was exceeded.Back off using 2^attemptCount times 200 milliseconds, reading the X-RateLimit-State and X-RateLimit-Period-In-Sec headers, before retrying.
500Internal Server ErrorAn unexpected error occurred on Opsgenie's side.Retry with backoff, and if it persists contact support with the requestId from the response.
Versioning & freshness

Version history.

Opsgenie's current REST API is version 2, reached through a v2 path segment, with a few endpoints such as incidents still served under v1. There is no dated version string to pin.

Version history

What changed, and when

Latest versionv2
v2Current version
Current REST API (v2), with an Atlassian end-of-support date

The current REST API is version 2, reached through a v2 path segment, with a few endpoints such as incidents still served under v1. There is no dated version string to pin. Atlassian stopped selling Opsgenie on 4 June 2025, and existing customers can keep using it until end of support on 5 April 2027, after which it shuts down and unmigrated data is deleted. Atlassian directs customers to Jira Service Management for alerting, on-call, and incident management, and to Compass for some operations capabilities.

What changed
  • End of sale on 4 June 2025: Opsgenie is no longer available for new purchases, upgrades, or downgrades
  • End of support on 5 April 2027: the product shuts down and unmigrated data is deleted
  • Recommended migration to Jira Service Management for alerting, on-call, and incident management
  • An automated migration tool is provided under settings to move data and configuration
Earlier
Legacy v1 endpoints

Before the version 2 REST API, Opsgenie served a version 1 API. Most areas moved to version 2, but some endpoints, such as the incident area, remain under a v1 path segment, so an integration spans both. The older policy area also has a deprecated form that the current policy endpoints replace.

What changed
  • Version 2 became the current REST API across most areas
  • Incident endpoints remain under v1
  • An earlier policy API was deprecated in favor of the current policy endpoints

Atlassian has set an end-of-support date for Opsgenie, so an integration built on it should plan to move.

Opsgenie migration and end-of-support notice ↗
Questions

Opsgenie API, answered.

How does an agent authenticate to the Opsgenie API?+
Every request sends an API key in the Authorization header as 'GenieKey '. The key is created on an API integration inside Opsgenie, under integration settings, not generated per user. Basic authentication with the key as the password is also accepted. The integration the key belongs to can be limited to one team, which narrows what the key sees.
Does Opsgenie have per-endpoint scopes like OAuth?+
No. Opsgenie does not offer granular per-endpoint OAuth scopes. A key carries four broad access-right toggles: Read Access, Create and Update Access, Delete Access, and Configuration Access. These apply across whole areas, not single methods, so turning off Configuration Access blocks the user, team, schedule, escalation, integration, and policy areas together. To narrow access further, scope the integration the key sits on to a specific team.
Why did my create or acknowledge call return 202 instead of 200?+
Most write actions on alerts and incidents are processed asynchronously. The call returns 202 Accepted straight away with a requestId, before the work has finished. To confirm the outcome, the request-status endpoint for that area is polled with the requestId, which returns whether the action succeeded and the resulting entity id. A 202 means the request was accepted and queued, not that it has completed.
What are the rate limits?+
Opsgenie uses a token-bucket model applied separately to each request domain, such as Alert, Incident, Heartbeat, Configuration, and Search, so each area has its own budget over a per-second and a per-minute window. Going over returns 429 Too Many Requests with X-RateLimit-State, X-RateLimit-Reason, and X-RateLimit-Period-In-Sec headers describing the throttle. The recommended response is exponential backoff, waiting 2^attemptCount times 200 milliseconds before retrying.
Is the EU instance on a different host?+
Yes. Accounts hosted in the EU call api.eu.opsgenie.com instead of api.opsgenie.com, with the same paths and the same GenieKey authentication. A key issued in one region only works against that region's host, so a call to the wrong host fails authentication.
Is Opsgenie being discontinued?+
Yes. Atlassian stopped selling Opsgenie on 4 June 2025 and has set end of support for 5 April 2027, after which the product shuts down and unmigrated data is deleted. Atlassian directs existing customers to Jira Service Management for alerting, on-call, and incident management, and to Compass for some operations capabilities. An integration built on the Opsgenie API should plan to move before that date.
Related

More developer API guides for agents

What is Bollard AI?

Control what every AI agent can do in Opsgenie.

Bollard AI sits between a team's AI agents and Opsgenie. Grant each agent exactly the access it needs, read or write, area by area, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Opsgenie API key.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Opsgenie
On-Call Agent
Read alerts ResourceOffReadFull use
Acknowledge and close alerts ActionOffReadFull use
Read who is on call ResourceOffReadFull use
Delete users ActionOffReadFull use
Per-agent access, set in Bollard AI, not in Opsgenie