--- title: "Search for incidents" method: GET path: "/api/v2/incidents/search" tags: ["Incidents"] --- # Search for incidents `GET /api/v2/incidents/search` Search for incidents matching a certain query. ## Query parameters - `include` 'users' | 'attachments' — Object related to an incident. - `query` string, required - `sort` 'created' | '-created' — The ways searched incidents can be sorted. - `page[size]` integer - `page[offset]` integer ## Response `200` OK - IncidentSearchResponse — Response with incidents and facets. - `data` IncidentSearchResponseData, required — Data returned by an incident search. - `attributes` IncidentSearchResponseAttributes — Attributes returned by an incident search. - `facets` IncidentSearchResponseFacetsData, required — Facet data for incidents returned by a search query. - `commander` IncidentSearchResponseUserFacetData[] — Facet data for incident commander users. - `count` integer — Count of the facet value appearing in search results. - `email` string — Email of the user. - `handle` string — Handle of the user. - `name` string — Name of the user. - `uuid` string — ID of the user. - `created_by` IncidentSearchResponseUserFacetData[] — Facet data for incident creator users. - `count` integer — Count of the facet value appearing in search results. - `email` string — Email of the user. - `handle` string — Handle of the user. - `name` string — Name of the user. - `uuid` string — ID of the user. - `fields` IncidentSearchResponsePropertyFieldFacetData[] — Facet data for incident property fields. - `aggregates` IncidentSearchResponseNumericFacetDataAggregates — Aggregate information for numeric incident data. - `max` number, double, nullable — Maximum value of the numeric aggregates. - `min` number, double, nullable — Minimum value of the numeric aggregates. - `facets` IncidentSearchResponseFieldFacetData[], required — Facet data for the property field of an incident. - `count` integer — Count of the facet value appearing in search results. - `name` string — The facet value appearing in search results. - `name` string, required — Name of the incident property field. - `impact` IncidentSearchResponseFieldFacetData[] — Facet data for incident impact attributes. - `count` integer — Count of the facet value appearing in search results. - `name` string — The facet value appearing in search results. - `last_modified_by` IncidentSearchResponseUserFacetData[] — Facet data for incident last modified by users. - `count` integer — Count of the facet value appearing in search results. - `email` string — Email of the user. - `handle` string — Handle of the user. - `name` string — Name of the user. - `uuid` string — ID of the user. - `postmortem` IncidentSearchResponseFieldFacetData[] — Facet data for incident postmortem existence. - `count` integer — Count of the facet value appearing in search results. - `name` string — The facet value appearing in search results. - `responder` IncidentSearchResponseUserFacetData[] — Facet data for incident responder users. - `count` integer — Count of the facet value appearing in search results. - `email` string — Email of the user. - `handle` string — Handle of the user. - `name` string — Name of the user. - `uuid` string — ID of the user. - `severity` IncidentSearchResponseFieldFacetData[] — Facet data for incident severity attributes. - `count` integer — Count of the facet value appearing in search results. - `name` string — The facet value appearing in search results. - `state` IncidentSearchResponseFieldFacetData[] — Facet data for incident state attributes. - `count` integer — Count of the facet value appearing in search results. - `name` string — The facet value appearing in search results. - `time_to_repair` IncidentSearchResponseNumericFacetData[] — Facet data for incident time to repair metrics. - `aggregates` IncidentSearchResponseNumericFacetDataAggregates, required — Aggregate information for numeric incident data. - `max` number, double, nullable — Maximum value of the numeric aggregates. - `min` number, double, nullable — Minimum value of the numeric aggregates. - `name` string, required — Name of the incident property field. - `time_to_resolve` IncidentSearchResponseNumericFacetData[] — Facet data for incident time to resolve metrics. - `aggregates` IncidentSearchResponseNumericFacetDataAggregates, required — Aggregate information for numeric incident data. - `max` number, double, nullable — Maximum value of the numeric aggregates. - `min` number, double, nullable — Minimum value of the numeric aggregates. - `name` string, required — Name of the incident property field. - `incidents` IncidentSearchResponseIncidentsData[], required — Incidents returned by the search. - `data` IncidentResponseData, required — Incident data from a response. - `attributes` IncidentResponseAttributes — The incident's attributes from a response. - `archived` string, date-time, nullable — Timestamp of when the incident was archived. - `case_id` integer, nullable — The incident case id. - `created` string, date-time — Timestamp when the incident was created. - `customer_impact_duration` integer — Length of the incident's customer impact in seconds. Equals the difference between `customer_impact_start` and `customer_impact_end`. - `customer_impact_end` string, date-time, nullable — Timestamp when customers were no longer impacted by the incident. - `customer_impact_scope` string, nullable — A summary of the impact customers experienced during the incident. - `customer_impact_start` string, date-time, nullable — Timestamp when customers began being impacted by the incident. - `customer_impacted` boolean — A flag indicating whether the incident caused customer impact. - `declared` string, date-time — Timestamp when the incident was declared. - `declared_by` IncidentNonDatadogCreator, nullable — Incident's non Datadog creator. - … - `declared_by_uuid` string, nullable — UUID of the user who declared the incident. - `detected` string, date-time, nullable — Timestamp when the incident was detected. - `fields` object — A condensed view of the user-defined fields attached to incidents. - `incident_type_uuid` string — A unique identifier that represents an incident type. - `is_test` boolean — A flag indicating whether the incident is a test incident. - `modified` string, date-time — Timestamp when the incident was last modified. - `non_datadog_creator` IncidentNonDatadogCreator, nullable — Incident's non Datadog creator. - … - `notification_handles` IncidentNotificationHandle[], nullable — Notification handles that will be notified of the incident during update. - … - `public_id` integer — The monotonically increasing integer ID for the incident. - `resolved` string, date-time, nullable — Timestamp when the incident's state was last changed from active or stable to resolved or completed. - `severity` 'UNKNOWN' | 'SEV-0' | 'SEV-1' | 'SEV-2' | 'SEV-3' | 'SEV-4' | 'SEV-5' — The incident severity. - `state` string, nullable — The state incident. - `time_to_detect` integer — The amount of time in seconds to detect the incident. Equals the difference between `customer_impact_start` and `detected`. - `time_to_internal_response` integer — The amount of time in seconds to call incident after detection. Equals the difference of `detected` and `created`. - `time_to_repair` integer — The amount of time in seconds to resolve customer impact after detecting the issue. Equals the difference between `customer_impact_end` and `detected`. - `time_to_resolve` integer — The amount of time in seconds to resolve the incident after it was created. Equals the difference between `created` and `resolved`. - `title` string, required — The title of the incident, which summarizes what happened. - `visibility` string, nullable — The incident visibility status. - `id` string, required — The incident's ID. - `relationships` IncidentResponseRelationships — The incident's relationships from a response. - `attachments` RelationshipToIncidentAttachment — A relationship reference for attachments. - … - `commander_user` NullableRelationshipToUser, nullable — Relationship to user. - … - `created_by_user` RelationshipToUser — Relationship to user. - … - `declared_by_user` RelationshipToUser — Relationship to user. - … - `impacts` RelationshipToIncidentImpacts — Relationship to impacts. - … - `integrations` RelationshipToIncidentIntegrationMetadatas — A relationship reference for multiple integration metadata objects. - … - `last_modified_by_user` RelationshipToUser — Relationship to user. - … - `responders` RelationshipToIncidentResponders — Relationship to incident responders. - … - `user_defined_fields` RelationshipToIncidentUserDefinedFields — Relationship to incident user defined fields. - … - `type` 'incidents', required — Incident resource type. - `total` integer, required — Number of incidents returned by the search. - `type` 'incidents_search_results' — Incident search result type. - `included` IncidentResponseIncludedItem[] — Included related resources that the user requested. - union — An object related to an incident that is included in the response. - IncidentUserData — User object returned by the API. - `attributes` IncidentUserAttributes — Attributes of user object returned by the API. - `email` string — Email of the user. - `handle` string — Handle of the user. - `icon` string — URL of the user's icon. - `name` string, nullable — Name of the user. - `uuid` string — UUID of the user. - `id` string — ID of the user. - `type` 'users' — Users resource type. - AttachmentData — Attachment data from a response. - `attributes` AttachmentDataAttributes, required — The attachment's attributes. - `attachment` AttachmentDataAttributesAttachment — The attachment object. - `documentUrl` string — The URL of the attachment. - `title` string — The title of the attachment. - `attachment_type` 'postmortem' | 'link' — The type of the attachment. - `modified` string, date-time — Timestamp when the attachment was last modified. - `id` string, required — The unique identifier of the attachment. - `relationships` AttachmentDataRelationships, required — The attachment's resource relationships. - `incident` RelationshipToIncident — Relationship to incident. - `data` RelationshipToIncidentData, required — Relationship to incident object. - … - `last_modified_by_user` RelationshipToUser — Relationship to user. - `data` RelationshipToUserData, required — Relationship to user object. - … - `type` 'incident_attachments', required — The incident attachment resource type. - `meta` IncidentSearchResponseMeta — The metadata object containing pagination metadata. - `pagination` IncidentResponseMetaPagination — Pagination properties. - `next_offset` integer — The index of the first element in the next page of results. Equal to page size added to the current offset. - `offset` integer — The index of the first element in the results. - `size` integer — Maximum size of pages to return. ## Other responses - `400` — Bad Request - `401` — Unauthorized - `403` — Forbidden - `404` — Not Found - `429` — Too many requests --- [API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)