Skip to main content

Sandbox incident flows

Create an incident and simulate ADT operator actions in a sandbox environment.

Overview​

In production, ADT operators handle alarms and Hyperion sends you those steps as a monitorable incident and its actions.

In sandbox, you can practice that same path. Create an event with one of the sandbox event types below. Hyperion opens a real incident on your premises and sends you the operator actions you would receive when ADT works an alarm.

Think of these event types like the service availability reference postal codes: one public API call, a predictable result you can build and test against.

These event types are for sandbox only. Do not send them in production.

Getting Started​

Before you start, you need:

  1. An activated premises monitorable.
  2. An application with the event:write and monitorable-incident:read scopes. If you have not created an application yet, see the Create Application API Reference.
  3. A partner access token. Use Set Access Token in the navbar to configure it for the request builders on this page.

To receive updates as they happen, create a webhook subscribed to monitorable-incident:create and monitorable-incident:action:create.

Create a sandbox incident​

Create an event for your premises with a sandbox event type from the table below. Hyperion opens a monitorable incident and attaches the operator actions for that story. Actions arrive one after another, not all at the same instant, so webhook notifications are spaced out the way they would be when ADT works a live alarm.

Path parameters

Request body

External identifier for the event. Alternatively, send the optional HTTP header External-Id when externalId is omitted or null; a string in the body takes precedence over the header.

Event type identifier

Date and time when the event was observed

Media entries associated with the event

cURL command

cURLPOST
curl -X POST "/v1/monitorables/:monitorableId/events" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -d '{
  "type": "INCIDENT_LIFECYCLE_FULL_VERIFICATION",
  "observedAt": "2026-10-29T16:45:54.114Z"
}'

💡 Set your access token in the navbar to auto-fill the Authorization header

Everyday event types such as INTRUSION and SILENT_ALERT still create an event. They do not open a monitorable incident.

Read the incident and actions​

After you create the event:

  1. List incidents for the premises with GET /v1/monitorables/{monitorableId}/incidents.
  2. List operator actions with GET /v1/monitorables/{monitorableId}/incidents/{incidentId}/actions.

You receive Hyperion action names such as DIALED_PRIMARY_CONTACT and AGENT_ASSIGNED. A close action (AGENT_CLOSED_INCIDENT or ELECTRONIC_CANCEL) sets the incident status to RESOLVED and sets resolvedAt.

If you subscribed a webhook, you also receive monitorable-incident:create when the incident opens, monitorable-incident:action:create for each operator action, and monitorable-incident:update when the incident is resolved.

Sandbox event types​

Event typeWhat the operator story coversActions you receive (in order)
INCIDENT_LIFECYCLE_FULL_VERIFICATIONPrimary contact answers, password accepted, no agencyAGENT_ASSIGNED → DIALED_PRIMARY_CONTACT → PRIMARY_CONTACT_ANSWERED → VERBAL_PASSWORD_ACCEPTED → NO_AGENCY_NOTIFICATION → AGENT_CLOSED_INCIDENT
INCIDENT_LIFECYCLE_MULTIPLE_CALLSVoicemail for the primary contact, then an emergency contactAGENT_ASSIGNED → DIALED_PRIMARY_CONTACT → LEFT_VOICEMAIL → DIALED_EMERGENCY_CONTACT → EMERGENCY_CONTACT_ANSWERED → VERBAL_PASSWORD_ACCEPTED → AGENT_CLOSED_INCIDENT
INCIDENT_LIFECYCLE_AGENCY_DISPATCHPrimary contact does not answer, then policeAGENT_ASSIGNED → DIALED_PRIMARY_CONTACT → PRIMARY_CONTACT_NO_ANSWER → AGENCY_NOTIFIED_POLICE → AGENT_CLOSED_INCIDENT
INCIDENT_LIFECYCLE_COMPLEXPrimary and emergency contacts, then policeAGENT_ASSIGNED → DIALED_PRIMARY_CONTACT → PRIMARY_CONTACT_NO_ANSWER → DIALED_EMERGENCY_CONTACT → LEFT_VOICEMAIL → AGENCY_NOTIFIED_POLICE → AGENT_CLOSED_INCIDENT
INCIDENT_LIFECYCLE_ELECTRONIC_CANCELPrimary contact is dialed, then an electronic cancelAGENT_ASSIGNED → DIALED_PRIMARY_CONTACT → ELECTRONIC_CANCEL

Conclusion​

You can now open a monitorable incident in sandbox and receive the same operator actions you will handle in production.

Next Steps​

API Reference​