{"openapi":"3.1.0","info":{"title":"Splunk On-Call (BYOK) API","version":"0.1.0","description":"Splunk On-Call (BYOK) lets an AI assistant read your own Splunk On-Call data through the Splunk On-Call API with a key you supply (Splunk On-Call API key). Read-only: 12 tools (list_current_incidents, get_incident, search_incident_history, list_teams, list_team_members, list_users, get_org_on_call_now, get_team_on_call_schedule, list_escalation_policies, get_escalation_policy, list_routing_keys,...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-victorops.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-victorops/docs"},"termsOfService":"https://connectorbay.com/byok-victorops/terms"},"servers":[{"url":"https://byok-victorops.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-victorops/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_current_incidents":{"post":{"operationId":"list_current_incidents","summary":"List the incidents that are currently open (triggered or acknowledged) with phase, alert count, host, service and who wa","description":"List the incidents that are currently open (triggered or acknowledged) with phase, alert count, host, service and who was paged. Use for \"Which incidents are open in Splunk On-Call right now\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"list_current_incidentsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_incident":{"post":{"operationId":"get_incident","summary":"Get one incident by number, including its state transitions (who acknowledged or resolved it and when). Use for \"Show th","description":"Get one incident by number, including its state transitions (who acknowledged or resolved it and when). Use for \"Show the details and history of Splunk On-Call incident 42\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"incident_number":{"description":"Incident number as shown in Splunk On-Call.","minimum":1,"title":"Incident Number","type":"integer"}},"required":["incident_number"],"title":"get_incidentArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/search_incident_history":{"post":{"operationId":"search_incident_history","summary":"Search past incidents (reporting API) by time range, host, service, phase or routing key. Returns up to 100 per call; pa","description":"Search past incidents (reporting API) by time range, host, service, phase or routing key. Returns up to 100 per call; page with offset. Use for \"Which Splunk On-Call incidents on service 'disk' started after 1 October 2026\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"started_after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Only incidents started after this ISO 8601 time, for example 2026-10-01T00:00:00Z.","title":"Started After"},"started_before":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Only incidents started before this ISO 8601 time.","title":"Started Before"},"host":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Host involved; several values may be separated by commas.","title":"Host"},"service":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Service involved; several values may be separated by commas.","title":"Service"},"current_phase":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Phase: resolved, triggered or acknowledged (comma-separate several).","title":"Current Phase"},"routing_key":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Original routing key of the incident.","title":"Routing Key"},"limit":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"Incidents to return (1 to 100).","title":"Limit"},"offset":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"How many matching incidents to skip, for paging.","title":"Offset"}},"title":"search_incident_historyArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_teams":{"post":{"operationId":"list_teams","summary":"List all teams with name, slug, member count and whether it is the default team. Use for \"What teams exist in Splunk On-","description":"List all teams with name, slug, member count and whether it is the default team. Use for \"What teams exist in Splunk On-Call\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"list_teamsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_team_members":{"post":{"operationId":"list_team_members","summary":"List the members of a team with username and name. Use for \"Who is on the Splunk On-Call team team-abc123\".","description":"List the members of a team with username and name. Use for \"Who is on the Splunk On-Call team team-abc123\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"team":{"description":"Team slug (the URL-safe team identifier, for example 'team-abc123'), as returned by list_teams.","maxLength":200,"title":"Team","type":"string"}},"required":["team"],"title":"list_team_membersArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_users":{"post":{"operationId":"list_users","summary":"List users in the organization with username, name, creation time and verification flag (email addresses are left out). ","description":"List users in the organization with username, name, creation time and verification flag (email addresses are left out). Use for \"List the users in our Splunk On-Call organization\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"list_usersArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_org_on_call_now":{"post":{"operationId":"get_org_on_call_now","summary":"List who is on call right now for every team. Use for \"Who is on call right now in Splunk On-Call\".","description":"List who is on call right now for every team. Use for \"Who is on call right now in Splunk On-Call\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"get_org_on_call_nowArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_team_on_call_schedule":{"post":{"operationId":"get_team_on_call_schedule","summary":"Get a team's on-call schedule per escalation policy for the coming days, including overrides. Use for \"What is the on-ca","description":"Get a team's on-call schedule per escalation policy for the coming days, including overrides. Use for \"What is the on-call schedule for team-abc123 next week\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"team":{"description":"Team slug (the URL-safe team identifier, for example 'team-abc123'), as returned by list_teams.","maxLength":200,"title":"Team","type":"string"},"days_forward":{"anyOf":[{"maximum":123,"minimum":1,"type":"integer"},{"type":"null"}],"default":14,"description":"How many days ahead to include in the schedule (up to 123).","title":"Days Forward"},"days_skip":{"anyOf":[{"maximum":90,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"How many days to skip before the schedule starts (up to 90).","title":"Days Skip"}},"required":["team"],"title":"get_team_on_call_scheduleArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_escalation_policies":{"post":{"operationId":"list_escalation_policies","summary":"List escalation policies with their team. Optionally filter by policy name. Use for \"Which escalation policies exist in ","description":"List escalation policies with their team. Optionally filter by policy name. Use for \"Which escalation policies exist in Splunk On-Call\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"filter":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Only policies whose name contains this text.","title":"Filter"}},"title":"list_escalation_policiesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_escalation_policy":{"post":{"operationId":"get_escalation_policy","summary":"Get one escalation policy with its steps and timeouts. Use for \"Show the steps of escalation policy pol-1\".","description":"Get one escalation policy with its steps and timeouts. Use for \"Show the steps of escalation policy pol-1\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"policy":{"description":"Escalation policy slug in the form pol-xxxxxxxxxxxxxxxx, from list_escalation_policies.","maxLength":200,"title":"Policy","type":"string"}},"required":["policy"],"title":"get_escalation_policyArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_routing_keys":{"post":{"operationId":"list_routing_keys","summary":"List routing keys with the teams and policies each routes to. Use for \"What routing keys are configured in Splunk On-Cal","description":"List routing keys with the teams and policies each routes to. Use for \"What routing keys are configured in Splunk On-Call\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"list_routing_keysArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_maintenance_mode":{"post":{"operationId":"get_maintenance_mode","summary":"Show whether maintenance mode is active and which routing targets it silences. Use for \"Is Splunk On-Call in maintenance","description":"Show whether maintenance mode is active and which routing targets it silences. Use for \"Is Splunk On-Call in maintenance mode\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"get_maintenance_modeArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}