--- title: "Load incident data | Grafana Cloud documentation" description: "Load Grafana Incident data into workflows as a resource, with automatic loading for incident events and explicit declarations for any workflow." --- # Load incident data > Note > > Grafana Workflows is currently in [private preview](/docs/release-life-cycle/). Grafana Labs offers support on a best-effort basis, and breaking changes might occur prior to the feature being made generally available. Incident resources let workflows load full Grafana Incident data and reference individual fields in step inputs. The engine fetches incidents at the start of workflow execution, before any steps run. There are two ways incidents are loaded: - **Automatically** for workflows triggered by incident events - **Explicitly** through the `resources.incidents` section of the workflow definition ## Automatic loading for incident events When a workflow triggers on an incident event (any event matching `grafana_irm_app.incident.*`), the engine automatically fetches the full incident and makes it available under the key `event`: YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml spec: name: Respond to incident startWhen: matchingRules: - eventNameRegex: "grafana_irm_app\\.incident\\..*" steps: - id: notify type: slack.message.post inputs: channelID: "C0123456789" messageText: "Incident ${resources.incident.event.title} is ${resources.incident.event.status} (${resources.incident.event.severity})" ``` No configuration is required. The engine detects the incident event, extracts the incident ID from the event payload, and fetches the current incident data from the Grafana Incident API. ## Declare incident resources explicitly To load incidents that are not part of the triggering event, declare them in the `resources.incidents` section. Each entry maps a reference name to an incident URI using the `incident://id/` scheme: YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml spec: resources: incidents: related: "incident://id/456" current: "incident://id/${inputs.incident.incidentID}" ``` Values must use the `incident://id/` URI prefix followed by the numeric incident ID. The `id/` path segment distinguishes ID lookups from future URI types. CEL expressions are supported in the path and are evaluated before the URI is parsed: - **Literal URIs**: A constant incident URI such as `"incident://id/456"`. - **CEL expressions in the URI**: Use `${expression}` in the path, for example `"incident://id/${inputs.incident.incidentID}"` to pull the ID from the triggering event data. ## Reference incident fields in step inputs Access incident fields using `${resources.incident..}` syntax in step inputs: YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml steps: - id: post-summary type: slack.message.post inputs: channelID: "C0123456789" messageText: | Incident: ${resources.incident.event.title} Status: ${resources.incident.event.status} Severity: ${resources.incident.event.severity} Created: ${resources.incident.event.createdTime} ``` ### Available fields The incident object contains these fields, using camelCase names that match the Grafana Incident API: Expand table | Field | Type | Description | |----------------------|--------|-----------------------------------------------------| | `incidentID` | string | The incident identifier. | | `title` | string | The incident title. | | `status` | string | Current status, for example `active` or `resolved`. | | `severity` | string | Severity level, for example `critical` or `major`. | | `summary` | string | A short recap of the incident. | | `isDrill` | bool | Whether the incident is a drill. | | `createdTime` | string | When the incident was created (RFC 3339). | | `modifiedTime` | string | When the incident was last modified (RFC 3339). | | `closedTime` | string | When the incident was closed (RFC 3339). | | `incidentStart` | string | When the incident began (RFC 3339). | | `incidentEnd` | string | When the incident ended (RFC 3339). | | `durationSeconds` | int | How long the incident has been open. | | `overviewURL` | string | URL to the incident overview page. | | `labels` | array | Labels associated with the incident. | | `incidentMembership` | object | People involved in the incident. | | `taskList` | object | Tasks associated with the incident. | | `createdByUser` | object | The user who created the incident. | ## Combine automatic and explicit resources A workflow can use both automatic and explicit incident resources. When a workflow triggers on an incident event and also declares explicit resources, both are available. If an explicit entry uses the key `event`, it overrides the auto-loaded incident: YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml spec: startWhen: matchingRules: - eventNameRegex: "grafana_irm_app\\.incident\\.updated" resources: incidents: related: "incident://id/456" steps: - id: compare type: transform inputs: template: "Event incident: ${resources.incident.event.title}, Related: ${resources.incident.related.title}" ``` In this example, `resources.incident.event` is auto-loaded from the triggering incident event, and `resources.incident.related` is loaded from the explicitly declared ID. ## Error handling If any incident fails to load (invalid ID, API unreachable, or authentication failure), the workflow fails immediately before any steps execute. This applies to both auto-loaded and explicitly declared incidents. ## Next steps - [Create workflows](/docs/grafana-cloud/alerting-and-irm/workflows/create-workflows) - [Load alert group data](/docs/grafana-cloud/alerting-and-irm/workflows/load-alert-group-data) - [Use CEL expressions](/docs/grafana-cloud/alerting-and-irm/workflows/use-expressions) - [Manage secrets](/docs/grafana-cloud/alerting-and-irm/workflows/manage-secrets) - [Step types reference](/docs/grafana-cloud/alerting-and-irm/workflows/reference)