---
title: "List Signals"
method: GET
path: "/v1/accounts/{account_id}/signals"
tags: ["Reseller"]
---

# List Signals

`GET /v1/accounts/{account_id}/signals`

Shows details of Signals belonging to the account associated with your API credentials.

Signals are used to highlight interesting user or system behaviors that an analyst can reference during a cyber investigation.
A detected Signal could be as broad and low fidelity as the detection of a command line user running whoami, or it could be as specific and high fidelity as detecting a known malware file.

**Note:** This endpoint will also return a `pagination` key on the root level.  
Please refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.

## Path parameters

- `account_id` integer, required

## Query parameters

- `limit` integer
- `page_token` string
- `sort_field` 'id' | 'created_at' | 'updated_at' | 'status'
- `sort_direction` 'asc' | 'desc'
- `investigated_at_min` string
- `investigated_at_max` string
- `entity_type` 'user_entity' | 'source' | 'mailbox' | 'service_principal' | 'agent' | 'identity'
- `entity_id` string
- `organization_id` integer
- `types` string
- `statuses` string

## Response `200`

List Signals

- object
  - `signals` Signal[], required
    - `id` integer — A unique identifier for the signal.
    - `created_at` string, date-time — ISO-8601 formatted timestamp for when this signal was created.
    - `details` object — Additional details attached to this signal. These details differ based on the signal type and contain information about where the signal originated.
    - `entity` object — Additional details about the entity from which the signal originated. This will always contain an ID, Type and Name.
    - `investigated_at` string — ISO-8601 formatted timestamp for when this signal was investigated.
    - `investigation_context` string — Represents categories attached to the signal by a SOC analyst which give extra insight on the investigation.
    - `name` string — The name of the signal.
    - `organization` object — Contains information about the organization this signal came from. Includes the organization ID and name.
    - `status` string — The status of the signal. Can be one of: `reported`, `closed`
    - `type` string — The type of the signal. Can be one of: `Antivirus, Process Insights, Managed ITDR, Footholds, MDE Detections, SIEM, Ransomware Canaries, Favicon Detections, Attack Disruptions, App Control`
    - `updated_at` string, date-time — ISO-8601 formatted timestamp for when this signal was last updated.
  - `pagination` Pagination, required — Pagination model
    - `next_page_url` string
    - `next_page_token` string

## Other responses

- `403` — There was an issue with your API credential or permissions.

---

[API](https://skmtc.net/huntress/apis/huntress-api-reference.md) · [All operations](https://skmtc.net/huntress/apis/huntress-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huntress/huntress-api-reference/revisions/94acb422c07d/schema)