# Create incident URL: https://docs.hanzo.ai/docs/openapi/patrol/post-patrol-incident > Records a response by hand, in state received and carrying the site's tier and SLA. `POST /v1/patrol/incident` > [Patrol →](https://docs.hanzo.ai/docs/openapi/patrol) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | ----------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/patrol/incident` | | **Method** | `POST` | | **Operation** | `post_patrol_incident` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Records a response by hand, in state received and carrying the site's tier and SLA. It is what a controller calls when an activation arrives by phone rather than over the intake. ## Request 4 fields, body `application/json` (required). | Field | In | Type | Required | Description | | --------- | ---- | ------ | -------- | ------------------------------------------------ | | `ref` | body | string | — | Ref is the receiving centre's own reference. | | `site` | body | string | — | Site is where it is happening, by document name. | | `trigger` | body | string | — | Trigger is what was reported. | | `zone` | body | string | — | Zone is the panel zone that reported. | ## Response | Status | Body | Meaning | | --------- | ------------------------ | ------- | | `201` | patrol.patrolIncidentOut | created | | `default` | problem-details | refused | `201` body — 34 fields. | Field | In | Type | Always | Description | | ----------------------- | ---- | --------------------- | ------ | ---------------------------------------------------------------------------------------------------- | | `data` | body | patrol.patrolIncident | — | | | `data.checked` | body | string | — | Checked is when the premises had been walked. | | `data.clocks` | body | patrol.patrolClock\[] | — | Clocks is the SLA clocks, present on a single-incident read. | | `data.clocks[].elapsed` | body | integer (int64) | — | Elapsed is the seconds run so far, or the seconds it took when settled. | | `data.clocks[].label` | body | string | — | Label names the clock: Verify, Dispatch or On site. | | `data.clocks[].settled` | body | integer (int64) | — | Settled is the seconds it took, or -1 while the clock is still running. | | `data.clocks[].target` | body | integer (int64) | — | Target is the contracted seconds. | | `data.closed` | body | string | — | Closed is when the incident was closed. | | `data.dispatched` | body | string | — | Dispatched is when a unit was assigned. | | `data.enroute` | body | string | — | Enroute is when that unit started moving. | | `data.escalated` | body | string | — | Escalated is when it was escalated, or empty. | | `data.false` | body | boolean | — | False says the activation turned out to be nothing. | | `data.filed` | body | string | — | Filed is when the report was written. | | `data.name` | body | string | — | Name is the incident's document name. | | `data.onsite` | body | string | — | Onsite is when it arrived. | | `data.opened` | body | string | — | Opened is when the activation landed. | | `data.outcome` | body | string | — | Outcome is what it came to. | | `data.ref` | body | string | — | Ref is the receiving centre's own reference. | | `data.secured` | body | string | — | Secured is when the site was made safe. | | `data.site` | body | string | — | Site is where it is happening. | | `data.sla` | body | integer (int64) | — | SLA is the contracted response time in minutes. | | `data.state` | body | string | — | State is one of received, verified, dispatched, enroute, onsite, checked, secured, filed and closed. | | `data.steps` | body | patrol.patrolAct\[] | — | Steps is the act trail, present on a single-incident read. | | `data.steps[].act` | body | string | — | Act is the act performed. | | `data.steps[].actor` | body | string | — | Actor is who performed it. | | `data.steps[].at` | body | string | — | At is when it happened. | | `data.steps[].detail` | body | string | — | Detail is what they wrote with it. | | `data.steps[].from` | body | string | — | From is the state the incident left. | | `data.steps[].to` | body | string | — | To is the state it landed in. | | `data.tier` | body | string | — | Tier is the site's contracted service tier. | | `data.trigger` | body | string | — | Trigger is what the panel reported. | | `data.unit` | body | string | — | Unit is the call sign attending, or empty. | | `data.verified` | body | string | — | Verified is when the activation was confirmed real. | | `data.zone` | body | string | — | Zone is the panel zone that reported. | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo patrol incident create ``` **SDK** **.ts** ```ts import { Configuration, PatrolApi } from 'hanzoai'; const api = new PatrolApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.postPatrolIncident({ ref: "", site: "" }); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import PatrolApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = PatrolApi(client).post_patrol_incident(ref="", site="") ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.PatrolAPI.PostPatrolIncident(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, patrol_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = patrol_api::post_patrol_incident(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.PatrolApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new PatrolApi(client).postPatrolIncident(); ``` **HTTP** ```bash curl -X POST https://api.hanzo.ai/v1/patrol/incident \ -H "Authorization: Bearer $HANZO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "ref": "", "site": "" }' ``` **MCP** MCP reaches **patrol** through the `patrol` tool, which names its 26 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "get_patrol_camera" } } }' ``` --- [Patrol API](https://docs.hanzo.ai/docs/openapi/patrol) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)