> ## Documentation Index
> Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigate a production incident

> An API Policy Token example for an agent that reads production status, deployment history and logs to find the cause of an incident, and cannot change anything.

An on-call agent that looks at production when something breaks. It reads the status of every service, the deployment history and the logs, and reports what changed and what it thinks the cause is. It cannot change, deploy or delete anything.

**Level:** Read only. See all the [agent policy examples](https://www.qovery.com/docs/configuration/organization/policy-examples/overview.md).

## What the agent does

1. Finds the failing service in the production environment.
2. Reads its status, its recent deployments and the environment logs.
3. Compares the failing deployment with the last healthy one.
4. Writes a short report: what broke, when, the likely cause, and the fix it suggests to a human.

## What the policy allows

> [card] The agent can
>
> * Find the organization, project and environment by name, as the Qovery CLI does
> * Read the production environment: services, status, deployment history and logs

> [card] The agent cannot
>
> * Read environment variable values, even in production
> * Deploy, redeploy, restart or stop anything
> * Change any configuration, or delete anything
> * Read any other environment

Anything the policy does not allow is refused with `401 Unauthorized`.

## The policy

Copy it, then replace each `REPLACE_WITH_...` value with a real ID from your organization.

```rego investigate-production-incident.rego theme={null}
default allow := false

organization_id := "REPLACE_WITH_ORGANIZATION_ID"
project_id := "REPLACE_WITH_PROJECT_ID"
production_environment_id := "REPLACE_WITH_PRODUCTION_ENVIRONMENT_ID"

allow if cli_lookup
allow if read_production

# Let the Qovery CLI find the organization, project and environment by name.
cli_lookup if {
	input.request.method == "GET"
	input.request.path in {
		["api", "organization"],
		["api", "organization", organization_id],
		["api", "organization", organization_id, "project"],
		["api", "project", project_id],
		["api", "project", project_id, "environment"],
	}
}

# Read production: services, status, deployment history and logs.
# Environment variables are left out, because their values can be sensitive.
read_production if {
	input.request.method in {"GET", "HEAD"}
	input.qovery_metadata.environment_id == production_environment_id
	not "environmentVariable" in input.request.path
}
```

| Value | What to put |
| - | - |
| `organization_id` | your organization |
| `project_id` | the project that holds production |
| `production_environment_id` | the production environment |

You can copy the IDs from the Console URL, or list them with `qovery project list`, `qovery environment list` and `qovery application list`.

## Create the token

> [tab] With the coding agent
>
> In a session signed in as an organization Owner or Admin, ask:
>
> ```
> /qovery-policy-token read-only access to the production environment of my project, including logs and deployment history, but not environment variables. No writes, no deploys, no deletes.
> ```
>
> The `qovery-policy-token` skill finds the IDs, writes a policy like the one above, tests it locally and against the API, then creates the token.

> [tab] In the Console
>
> 1. Open your organization settings, then **Token API**.
> 2. In **Policy API Token**, click **Add new**.
> 3. Enter a name and a description, and paste the policy with your IDs.
> 4. Copy the token (`sk-qov-01-...`). It is shown once.

## Prompt for the agent

The agent runs with the [Qovery Agent Skills](https://www.qovery.com/docs/getting-started/quickstart/agent-skills.md) and the [Qovery CLI](https://www.qovery.com/docs/cli/overview.md), in Claude Code, Codex, Cursor or any agent that supports skills. Give it the token through the environment, never in the prompt:

```bash theme={null}
export QOVERY_CLI_ACCESS_TOKEN="sk-qov-01-..."
```

Then give the agent its task:

```
Our production checkout service started failing about 20 minutes ago.
Use Qovery to investigate. The project is "shop" and the environment is "production".

1. Find which services are not healthy and since when.
2. Read the deployment history and the logs of the failing services.
3. Compare the last failing deployment with the last healthy one.
4. Give me a short report: what broke, the most likely cause, and the fix you suggest.

Do not try to change or redeploy anything. Your token only allows reads.
```

Every call the agent makes appears in the [audit logs](https://www.qovery.com/docs/getting-started/security-and-compliance/audit-logs.md) as `policy:<token-id>:<token-name>`.

## Good to know

* This is the safest place to start: the token cannot change production, so you can give it to an agent on day one.
* If you also want the agent to read logs through the [Qovery MCP Server](https://www.qovery.com/docs/copilot/mcp-server.md), use an API token with a read-only role for the MCP Server. It does not accept API Policy Tokens.

## Related

> [card] [All agent policy examples](https://www.qovery.com/docs/configuration/organization/policy-examples/overview.md)
>
> Every use case, from read only to production changes.

> [card] [API Policy Token (Preview)](https://www.qovery.com/docs/configuration/organization/api-policy-token.md)
>
> How policies are evaluated, the input they see, and the limits.


## Related topics

- [Agent policy examples](https://www.qovery.com/docs/configuration/organization/policy-examples/overview.md)
- [Incident Analyzer with incident.io](https://www.qovery.com/docs/configuration/agent-tasks/incident-analyser.md)
- [Incident Analyzer with Honeybadger](https://www.qovery.com/docs/configuration/agent-tasks/incident-analyser-honeybadger.md)
- [What is Agentic AI?](https://www.qovery.com/docs/copilot/what-is-agentic-ai.md)
- [Getting Started with Qovery AI Copilot](https://www.qovery.com/docs/copilot/getting-started.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.