How does the Incident.io integration work?

Last updated: January 15, 2026

Overview

The incident.io integration brings your incident management data into Span, enabling comprehensive reliability insights and DORA metrics tracking. By connecting your incident.io account, Span automatically imports incident data to power team-level reliability analytics, mean time to recover (MTTR) calculations, and change failure rate tracking.

What Data Does Span Import?

Span connects to incident.io's API and imports the following data:

Incidents

Complete incident records including:

  • Core details: Incident ID, title, description, and reference number

  • Status tracking: Current status, severity level, and incident type

  • Timestamps: Created, acknowledged, and resolved times

  • Resolution metrics: Time to resolution (for MTTR calculations)

  • Assignments: Incident responders and role assignments

  • Context: Linked services, environment (production/staging), and team ownership

  • Documentation: Links to postmortems, Slack channels, and external issue trackers

  • Custom fields: Any custom fields you've configured in incident.io

Users

User accounts from incident.io, enabling Span to:

  • Link incidents to team members

  • Track incident responders and on-call assignments

  • Attribute incidents to the right people and teams

Metadata

  • Custom field definitions

  • Severity levels

  • Incident catalog types (services, teams, etc.)

All data syncs automatically via Airbyte with full refresh, ensuring your Span reports always reflect your latest incident.io data.

Reports & Insights Powered by incident.io

DORA Metrics Dashboard

The incident.io integration powers three critical DORA metrics:

1. Mean Time to Recover (MTTR)

  • What it measures: Average time from incident acknowledgment to resolution

  • How it's calculated: Uses incident timestamps ("Acknowledged at" → "Resolved at")

  • Visualization:

    • Percentile views (P50, P75, P90)

    • Scatterplot showing individual incident recovery times

    • Trend charts over time

  • Filtering: Filter by team, service, environment, or date range

  • Drill-down: Click any point to view full incident details

2. Incident Frequency

  • What it measures: Average number of incidents per week

  • How it's calculated: Total production incidents divided by time period

  • Filtering: Production incidents only (auto-filtered by environment)

  • Use case: Track reliability trends and incident volume over time

3. Change Failure Rate (CFR)

  • What it measures: Ratio of incidents to production deployments

  • How it's calculated: (Total Incidents) / (Total Production Deployments)

  • Note: This metric provides an approximation for trend analysis. Span uses the total incident count relative to deployment frequency to estimate your change failure rate.

All DORA metrics are available in the Metrics > DORA section of Span.

Incident Analytics

Incident Explorer

Browse and analyze your incident history:

  • Grid view: Sortable table showing all incidents with key metadata

  • Columns: Title, severity, created date, resolved date, time to resolution, environment, linked services

  • Filtering: Filter by:

    • Date range

    • Severity level

    • Status

    • Environment (production, staging, etc.)

    • Linked services

    • Owning team

  • Export: Export filtered incident data for further analysis

Team-Level Incident Reports

View incidents attributed to each team:

  • Incidents by team: See which teams own the most incidents

  • Team MTTR: Compare recovery times across teams

  • Service impact: Understand which services each team's incidents affect

  • Team performance trends: Track improvements in incident response over time

Service Impact Analysis

Understand which services experience incidents:

  • Incidents per service: See incident volume by service

  • Service reliability: Track which services have frequent incidents

  • Cross-service patterns: Identify systemic issues affecting multiple services

Incident Details View

Click any incident to view comprehensive details:

Incident Metadata

  • Title, description, and reference ID

  • Severity and incident type

  • Current status and resolution status

  • Created, acknowledged, and resolved timestamps

  • Time to resolution (MTTR contribution)

Context & Relationships

  • Linked services: Which services were impacted

  • Owning team: Team responsible for incident response

  • Assigned responders: Who handled the incident

  • Environment: Production, staging, etc.

External Links

  • Direct link to incident.io incident page

  • Postmortem document (if available)

  • Associated Slack channel

  • Linked issues in external trackers (Jira, Linear, etc.)

  • Git repository and branch (if specified)

Custom Fields Any custom fields configured in your incident.io workspace are preserved and displayed in Span.

How incident.io Data Links to Other Span Data

Service Connections

Incidents linked to services in incident.io automatically connect to the same services in Span, enabling:

  • Service-level reliability metrics

  • "Which services are most incident-prone?" analysis

  • Correlation between deployment frequency and incidents per service

Team Ownership

Incidents inherit team ownership through two mechanisms:

  1. Direct ownership: Teams assigned as incident owners in incident.io

  2. Service ownership: Teams owning affected services inherit incident attribution

This enables:

  • Team-level MTTR comparisons

  • Incident volume by team

  • On-call burden analysis

User Accounts

incident.io users are matched to Span user accounts by email, allowing:

  • Assignment of incidents to specific team members

  • Tracking individual involvement in incident response

  • Responder workload analysis

Setting Up the Integration

Prerequisites

Setup Steps

  1. Navigate to Integrations

    • Go to Settings > Integrations in Span

    • Find "incident.io" in the incident management category

    • Click Connect

  2. Authenticate

    • Enter your incident.io API key

    • Click Verify Credentials

  3. Configure Sync

    • Span will automatically configure data streams for:

      • Incidents

      • Users

      • Custom fields

      • Severities

      • Catalog types

    • All streams use full refresh to ensure data accuracy

  4. Initial Sync

    • First sync imports your complete incident.io history

    • Subsequent syncs run automatically (default: every 24 hours)

    • Data freshness monitored with 6-hour SLA

  5. Verify

    • Navigate to Metrics > DORA to see your MTTR metrics

    • Check Catalog > Incidents to browse imported incidents

Best Practices

Custom Fields

Configure relevant custom fields in incident.io to track additional context:

  • Root cause categories: Track common failure patterns

  • Detection methods: Understand how incidents are discovered

  • Business impact: Categorize customer impact levels

All custom fields sync automatically to Span.

Service Linking

Always link incidents to affected services in incident.io:

  • Enables service-level reliability tracking in Span

  • Powers service health dashboards

  • Identifies high-risk services

Environment Tagging

Use consistent environment naming:

  • Span filters for production incidents using: prod, prd, or production in environment name

  • Non-production incidents are excluded from DORA metrics by default

  • Proper tagging ensures accurate CFR and MTTR calculations

Timestamp Accuracy

Ensure your team updates incident timestamps accurately:

  • Acknowledged at: When incident first triaged

  • Resolved at: When root cause addressed

  • Accurate timestamps produce meaningful MTTR metrics

Team Assignment

Assign incidents to appropriate teams in incident.io:

  • Enables team-level reliability reporting in Span

  • Supports fair team comparisons and benchmarking

  • Powers on-call workload analysis

Data Freshness & Sync Schedule

  • Sync frequency: Every 24 hours (configurable)

  • Sync type: Full refresh (complete historical data)

  • Freshness SLA: 6 hours

  • Monitoring: Automatic alerts if data becomes stale

  • Manual sync: Available in Settings > Integrations > incident.io

Frequently Asked Questions

Q: Can I create incidents in Span that sync back to incident.io?

Incidents created via Span's API remain in Span but do not sync back to incident.io. The integration is currently read-only from incident.io to Span.

Q: How far back does the initial sync go?

The initial sync imports your complete incident.io history with no time limit.

Q: What happens if I disconnect the integration?

Historical incident data remains in Span for reporting continuity, but new incidents will no longer sync. DORA metrics will stop updating with new incident data.

Q: Can I filter incidents by custom fields?

Yes, all custom fields from incident.io are queryable in Span's incident explorer and available for filtering in reports.

Q: How does Span calculate Change Failure Rate without incident-deployment linking?

Span currently calculates CFR as the ratio of total incidents to total deployments in a given period. This provides a useful trend indicator. Direct incident-to-deployment linking is on the roadmap for more precise CFR calculations.

Q: Do all incident severities sync?

Yes, Span imports your severity definitions from incident.io and preserves severity levels on all incidents.

Q: What if my incident.io instance has incidents without resolved timestamps?

Unresolved incidents are imported but excluded from MTTR calculations until they reach a resolved status.

Troubleshooting

No incidents appearing in Span

  • Verify API key has correct permissions

  • Check that sync completed successfully in Settings > Integrations

  • Ensure incidents exist in your incident.io workspace

MTTR shows as 0 or missing

  • Confirm incidents have both "Acknowledged at" and "Resolved at" timestamps

  • Check that incidents are marked with production environment tags

  • Verify incidents aren't still in "Investigating" or "Monitoring" status

Incidents not linked to services

  • Ensure services in incident.io match service names in Span

  • Check that incident.io incidents have service catalog entries assigned

  • Service matching is case-sensitive

Team ownership not showing

  • Verify teams exist in Span (imported from HRIS or GitHub)

  • Check that incidents have assigned owners or linked services with team owners

  • Team matching uses email domain and org structure