Open dashboardSign inStart building

Generate an incident postmortem draft with AI

An agent combines a status page incident with an affected payment record and fills a blameless postmortem template.

  • Files
  • Read-only connection
  • Web
  • Budget cap

Watch a real run

A real run on Oct 7, 2026, replayed. Model: openai/gpt-6-luna.

Input
{
  "payment_id": "pay_124",
  "status_url": "https://ephemer.al/api/samples/status"
}
Succeededrun_19f2f90e2a609356f9dfd2cee0bc326a$0.004235 of $0.05
  1. Queuedbudget $0.05 reserved
  2. MicroVMmicroVM ready
  3. MicroVMworker started · shell off · web on
  4. Connectionpayments GET /payments/pay_124
  5. Connectionpayments GET /payments/pay_124/attempts
  6. Webweb_fetch https://ephemer.al/api/samples/status
  7. Fileread postmortem-template.md
  8. Resultpayments GET → 200
  9. Resultpayments GET → 200
  10. Resultweb https://ephemer.al/api/samples/status → 200
  11. MicroVMmicroVM destroyed
  12. Succeeded2 model calls, 4,039 tokensRecorded output (English)

    Postmortem: Elevated card payment errors in Europe

    Blameless. Describe what happened and what the system allowed, not who did it.

    Summary (2 sentences)

    On 2026-10-05, some EU card payments failed with processor timeouts during an incident. Payment pay_124 failed with a processor timeout and was not retried in the recorded attempt.

    Impact (who, how many, how long, money if known)

    One failed payment is documented: €129.00. Total customers and payments affected are not known. The incident timeline says affected failures occurred between 13:25 and 14:15 UTC.

    Timeline (UTC, one line each, only facts from the sources)

    • 2026-10-05 13:31 UTC — Incident investigating: some EU card payments failed with a processor timeout.
    • 2026-10-05 13:42:51 UTC — pay_124 failed; its attempt recorded a processor timeout.
    • 2026-10-05 13:58 UTC — Incident identified as a network change at one acquiring partner.
    • 2026-10-05 14:20 UTC — Incident resolved; card payments in Europe were processing normally. Failed payments from 13:25–14:15 UTC could be retried.

    Cause

    The incident source attributes the errors to a network change at one acquiring partner.

    What went well

    The incident was identified and resolved, and the status update said affected payments could be retried.

    Action items (owner role, not a person)

    Not known from the sources.

  13. Worker destroyed$0.004235 charged, $0.045765 released
Model $0.000435 · Web $0.001 · Compute $0.0028

Run it yourself

Open the sample in the playground with the whole request filled in. It runs on your own account, within the budget shown, against the same read-only sample systems.

Budget for this sample: $0.05

Open in the playgroundSign up to run itSign in

How it works

Two read-only sources, one template. The agent reads the incident timeline from the status page and the failed payment from the payments API, and writes only what those sources say. Action items name roles, not people.

What the agent can and cannot do

The permissions are part of the request. Anything not listed here is not available to the run.

SettingAllowed
Connections
payments: GET only, at ephemer.al/api/samples/payments-api
WebOnly ephemer.al
ShellOff
Filespostmortem-template.md (read-only)
Zero data retentionOff: the record is kept for 30 days
Budget$0.05, a hard cap
Timeout120 seconds

Credentials never enter the machine: a broker adds them to each call and enforces the methods above.

The code

This is the exact request the sample sends. Set EPHEMERAL_API_KEY to a member key of your organization.

curl -X POST $EPHEMERAL_URL/v1/runs \
  -H "Authorization: Bearer $EPHEMERAL_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d @request.json

Files in the request

Passed inline, so nothing is uploaded first. The agent sees each one as a read-only file.

postmortem-template.md
postmortem-template.md
# Postmortem: <title>

Blameless. Describe what happened and what the system allowed, not who did it.

## Summary (2 sentences)
## Impact (who, how many, how long, money if known)
## Timeline (UTC, one line each, only facts from the sources)
## Cause
## What went well
## Action items (owner role, not a person)
Full request body request.json

The same body, with the files inline.

request.json
{
  "prompt": "Write a postmortem draft for the incident that affected the payment in input.payment_id. Read the payment and its attempts from the payments connection, and the incident timeline from input.status_url with web_fetch. Fill postmortem-template.md, at most 250 words in total. Put every timeline line in UTC and only from the sources. If the sources do not show something (such as the number of customers affected), write 'not known' instead of estimating. Use only what the data returns and never guess; if a call fails or a field is missing, say so.",
  "input": {
    "payment_id": "pay_124",
    "status_url": "https://ephemer.al/api/samples/status"
  },
  "files": [
    {
      "path": "postmortem-template.md",
      "content": "# Postmortem: <title>\n\nBlameless. Describe what happened and what the system allowed, not who did it.\n\n## Summary (2 sentences)\n## Impact (who, how many, how long, money if known)\n## Timeline (UTC, one line each, only facts from the sources)\n## Cause\n## What went well\n## Action items (owner role, not a person)\n"
    }
  ],
  "connections": {
    "payments": {
      "type": "http",
      "url": "https://ephemer.al/api/samples/payments-api",
      "auth": {
        "type": "bearer",
        "token": "sample_read_key"
      },
      "allowed_methods": [
        "GET"
      ],
      "instructions": "GET /payments/{id} returns a payment (status, amount in cents, currency, failure_code, failure_message, attempt_count). GET /payments/{id}/attempts returns its attempts."
    }
  },
  "web": {
    "allow": [
      "ephemer.al"
    ],
    "search": false
  },
  "shell": false,
  "timeout_seconds": 120,
  "max_cost_micros": 50000
}

Read more

Related samples

esc

Nothing matches “”.