---
title: "oz0 incident link"
description: "Link an item to an incident."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/incident/link"
---
# oz0 incident link

> Link an item to an incident.

For: Operators and developers looking up a command.

Link an item to an incident. KIND is one of:

job JOB              a job (it is tagged incident:\<id>)
audit                an audit range: --since and --until, or --from-seq and --to-seq (at most 50,000 entries)
kill KILL-ID         a kill switch
receipt RCPT-ID      a kill or revocation receipt
egress seq:N         one egress denial, by its audit seq; or --job JOB for a job's, or --since/--until
finding ID           an eval finding
incident INC-ID      another incident of the tenant

Each item is checked in the incident's tenant and keeps its time and a summary for the timeline.

## Usage

```bash
oz0 incident link ID KIND [REF] [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --from-seq
      </code>
    </td>
    
    <td>
      int
    </td>
    
    <td>
      
    </td>
    
    <td>
      an audit range's first entry
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --job
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with egress: link every egress denial of this job (at most 100)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --reason
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      why, for the audit log (required; default $OZ0_REASON)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --since
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      an audit range's or egress denials' start: RFC 3339, or how long ago
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --to-seq
      </code>
    </td>
    
    <td>
      int
    </td>
    
    <td>
      <code>
        the chain's head
      </code>
    </td>
    
    <td>
      an audit range's last entry
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --until
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      their end (exclusive)
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tenant
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        default
      </code>
    </td>
    
    <td>
      the tenant
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.