Sign in
latestSwagger 2.02026-08-109450223.9 KB

94acb422c07d

Escalations

List Escalations

Shows Escalations associated with your account. Additional details for a specific escalation can be obtained by using the GET Escalation endpoint.

Escalations are used to notify Huntress account administrators that a situation requires their attention. Below are some common use cases:

  • Security Operation Centers (SOC) suspect that an application being flagged as malicious is a false positive, and we want to get your authorization to allow-list the application moving forward.
  • A potential threat flagged by Managed Defender requires additional information (file path details, etc.) in order for Huntress to provide actionable assisted remediation steps.
  • A login event occurred from an unexpected country or VPN, and Huntress would like partner feedback on whether that event should be expected or unauthorized.

Though Escalations are not incident reports, they do have severities (low, high, critical) associated with them that dictate an expected response time.

Note: This endpoint will also return a pagination key on the root level.
Please refer to the pagination section within our docs for more information.

get/v1/escalations

Query parameters

limitinteger

Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.

page_tokenstring

Token used to request the next page in paginated results. Defaults to 'null'

sort_field'id' | 'severity' | 'due_at' | 'created_at' | 'updated_at'

Field to sort by. Defaults to 'id'.

sort_direction'asc' | 'desc'

Sort direction. Defaults to 'desc'.

status'open' | 'overdue' | 'resolved'

Filter by status.

severity'low' | 'high' | 'critical'

Filter by severity.

subtypestring

Filter by subtype.

organization_idinteger

Filter by organization ID.

Response

List Escalations

Example response

{
  "escalations": [
    {
      "id": 84938,
      "account": {
        "id": 1,
        "name": "Your Account Name"
      },
      "organizations": [
        {
          "id": 1234,
          "name": "ExampleCo"
        }
      ],
      "created_at": "2025-09-05T18:20:34Z",
      "resolved_at": "2025-09-05T18:20:34Z",
      "severity": "low",
      "status": "resolved",
      "subject": "Defender Disabled",
      "subtype": "US",
      "type": "Environmental Issue",
      "updated_at": "2025-09-05T18:20:34Z"
    }
  ]
}