{"incident_id":1,"source":"fallback","markdown":"# Incident Post-Mortem\n\n> *Auto-generated by SiteWatch*\n\n## Summary\n\n`https://example.com/api/health` experienced a service disruption lasting **23 minutes**. Suspected cause: **Server error (503)**.\n\n## Timeline\n\n- **Mon, 25 May 2026 10:00:00 GMT** — First failure detected for `https://example.com/api/health`\n- **Mon, 25 May 2026 10:00:00 GMT** — HTTP 503 (1200ms)\n- **Mon, 25 May 2026 10:00:30 GMT** — HTTP 503 (1450ms)\n- **Mon, 25 May 2026 10:01:00 GMT** — HTTP 503 (1300ms)\n- **Mon, 25 May 2026 10:23:00 GMT** — Service recovered\n\n## Suspected Root Cause\n\n**Server error (503)**\n\nHTTP 503 responses indicate a server-side failure — application crash, overload, or upstream dependency down.\n\n## Impact\n\n| Field | Value |\n|-------|-------|\n| Endpoint | `https://example.com/api/health` |\n| Duration | 23 minutes |\n| First failure | Mon, 25 May 2026 10:00:00 GMT |\n| Recovery | Mon, 25 May 2026 10:23:00 GMT |\n\n## Recommended Next Step\n\nReview application error logs for stack traces around the incident window. Check upstream dependencies (database, cache, external APIs). Roll back the most recent deployment if the timing correlates.\n\n<details>\n<summary>Raw Signals</summary>\n\n**Check 1** — Mon, 25 May 2026 10:00:00 GMT\n- HTTP status: 503\n- Response time: 1200ms\n- Body snippet: `Service Unavailable`\n\n**Check 2** — Mon, 25 May 2026 10:00:30 GMT\n- HTTP status: 503\n- Response time: 1450ms\n\n**Check 3** — Mon, 25 May 2026 10:01:00 GMT\n- HTTP status: 503\n- Response time: 1300ms\n\n</details>\n","created_at":"2026-05-25T16:16:06.999Z","updated_at":"2026-05-25T16:16:06.999Z"}