---
title: "Get Incident Report"
method: GET
path: "/v1/accounts/{account_id}/incident_reports/{id}"
tags: ["Reseller"]
---

# Get Incident Report

`GET /v1/accounts/{account_id}/incident_reports/{id}`

Shows details on a single Incident Report associated with your account.

## Path parameters

- `account_id` integer, required
- `id` integer, required

## Response `200`

Get Incident Report

- object
  - `incident_report` IncidentReport — IncidentReport model
    - `id` integer — A unique identifier for an incident report.
    - `account_id` integer — Unique identifier for the account this incident report is associated with.
    - `agent_id` integer — Unique identifier for the agent this incident report is associated with.
    - `body` string — Autogenerated content describing the details of the incident in question.
    - `closed_at` string, date-time — ISO-8601 formatted timestamp for when this incident report had its status set to `closed`. Null if non-applicable.
    - `indicator_counts` object — Mapping of indicator types to number of incidences of that threat in the context of this incident report.
    - `indicator_types` string[] — Unique list of threat indicators that have been found in the context of this incident report.
    - `organization_id` integer — Unique identifier for the organization this incident report is associated with.
    - `platform` string — The platform of the host machine (`darwin`,`google`,`microsoft_365`,`linux`,`windows`, or `other`).
    - `remediations` object — This represents an itemized list of the first 10 remediations for an incident report. If there are more than 10, use the remediations endpoint to retrieve information about them.
    - `sent_at` string, date-time — ISO-8601 formatted timestamp for when a Huntress SOC analyst has notified necessary parties regarding this incident report. Null if not sent.
    - `severity` string — The severity of the incident report. Can be one of `low`, `high`, `critical`.
    - `status` string — Status of the incident report. Can be one of `sent`, `closed`, `dismissed`
    - `status_updated_at` string, date-time — ISO-8601 formatted timestamp for when the status of this incident report was last updated.
    - `subject` string — Autogenerated one-line description of the incident.
    - `summary` string — Details of the incident report, as provided by a Huntress SOC analyst.
    - `updated_at` string, date-time — ISO-8601 formatted timestamp for when this incident report was last updated.

## Other responses

- `403` — There was an issue with your API credential or permissions.

---

[API](https://skmtc.net/huntress/apis/huntress-api-reference.md) · [All operations](https://skmtc.net/huntress/apis/huntress-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huntress/huntress-api-reference/revisions/94acb422c07d/schema)