# Updates and roles

During an incident, your team posts **updates** to say what is known and what happens next. Each update can move the incident to its next status. **Roles** say who leads the response and who talks to customers. When customers need to know, publish an update to a status page.

## Post an update

1. Open the incident.
2. Under **Status for the next update**, select a stage if the status changes.
3. In the **Post update** panel, write the update in Markdown.
4. Select **Post update**, or **Post & mark identified** (or the stage you selected).

Updates are internal. Your team sees them on the incident timeline, and in the Slack incident channel. Customers do not see them. To tell customers, [publish to a status page](#publish-to-a-status-page).

With the [public API](/api-reference/incidents), send `POST /v1/incidents/{incident}/updates` with a `body` and an optional `status`. In Slack, use `/spectate update`.

An update does not change the title, the summary or the severity. To change them, select **Edit** on the incident. See [edit an incident](/incidents/introduction#edit-an-incident).

## Statuses

An incident moves through these statuses:

1. `investigating`: declared, the cause is not known yet.
2. `identified`: the cause is known and someone works on it.
3. `monitoring`: a fix is out, and the team watches whether it holds.
4. `resolved`: over.

You can skip a status. Acknowledging an incident moves it to `identified`. See [incidents](/incidents/introduction) for acknowledging and resolving.

## Roles

| Role | `role` in the API | Responsibility |
|---|---|---|
| Commander | `commander` | Leads the response and makes the calls. |
| Communications lead | `communications_lead` | Keeps customers and the company informed, for example through the status page. |

Each role has one person at a time. The person must be a member of the team.

### Assign a role

1. Open the incident.
2. In the **Roles** panel, select **Assign** next to the role, or **Change** if someone has it.
3. Under **Member**, select a team member.
4. Select **Assign role**.

The new person replaces whoever had the role. To clear a role, select **Remove**. In Slack, use `/spectate roles` or the **Roles** button in the incident channel.

## Timeline

The **Timeline** panel shows everything that happened, newest first:

- The declaration, and whether a person or an escalation path declared it.
- Updates, with their author and status.
- Acknowledgement and resolution.
- Status and severity changes, and edits to the title or summary.
- Role assignments.

Select **Updates** to see only the updates, or **All** to see everything. Spectate records who did each thing: a member, or the name of the API token. The public API returns the same entries at `GET /v1/incidents/{incident}/timeline`.

## Publish to a status page

Publish an update to tell customers about the incident on a [status page](/status-pages/incidents). The first update creates the public incident on that page. Later updates go to the same public incident.

1. Open the incident.
2. In the **Status pages** panel, select **Publish**, or **Update** next to a status page.
3. Select the **Status page**.
4. Select the **Public status**.
5. Select the **Impact** on each affected component.
6. Write the **Subscriber-facing update**.
7. Optional: change **Happened at**, if the update describes an earlier moment.
8. Keep **Notify subscribers by email** selected to email subscribers, or clear it.
9. Select **Publish update**.

:::caution
The status page update is public. With **Notify subscribers by email** selected, Spectate also emails the page's [subscribers](/status-pages/subscribers).
:::

Owners, managers and admins can publish to a status page. Members can post internal updates, but cannot publish. In Slack, use `/spectate status-page`. With the API, send `POST /v1/incidents/{incident}/status-page-updates`.

## Slack incident channel

If you [connected Slack](/alerting/slack), Spectate posts each update, status change, severity change, role change and status page update into the incident's Slack channel. It also posts edits of the title or summary. Things that people do in the channel show on the incident in the dashboard, with the right person. To add a Slack message to the timeline, react to it with the pushpin emoji. See [incident channels](/alerting/slack#incident-channels).

## Related

- [Postmortems](/incidents/postmortems): write down what happened after the incident.
- [Status page incidents](/status-pages/incidents): how public incidents look to customers.