---
title: "List Escalations"
method: GET
path: "/v1/escalations"
tags: ["Escalations"]
---

# List Escalations

`GET /v1/escalations`

Shows Escalations associated with your account.
Additional details for a specific escalation can be obtained by using the **GET Escalation** endpoint.

Escalations are used to notify Huntress account administrators that a situation requires their attention.
Below are some common use cases:
 - Security Operation Centers (SOC) suspect that an application being flagged as malicious is a false positive, and we want to get your authorization to allow-list the application moving forward.
 - A potential threat flagged by Managed Defender requires additional information (file path details, etc.) in order for Huntress to provide actionable assisted remediation steps.
 - A login event occurred from an unexpected country or VPN, and Huntress would like partner feedback on whether that event should be expected or unauthorized.

 Though Escalations are not incident reports, they do have severities (low, high, critical) associated with them that dictate an expected response time.

**Note:** This endpoint will also return a `pagination` key on the root level.  
Please refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.

## Query parameters

- `limit` integer
- `page_token` string
- `sort_field` 'id' | 'severity' | 'due_at' | 'created_at' | 'updated_at'
- `sort_direction` 'asc' | 'desc'
- `status` 'open' | 'overdue' | 'resolved'
- `severity` 'low' | 'high' | 'critical'
- `subtype` string
- `organization_id` integer

## Response `200`

List Escalations

- object
  - `escalations` Escalation[], required
    - `id` integer — A Huntress-unique identifier for the escalation.
    - `account` unknown
    - `organizations` string[] — An array of Organizations this escalation pertains to
    - `created_at` string, date-time — ISO-8601 formatted timestamp for when this escalation was created.
    - `resolved_at` string, date-time — ISO-8601 formatted timestamp for when this escalation was resolved.
    - `severity` 'low' | 'high' | 'critical' — The severity of the escalation.
    - `status` 'open' | 'sent' | 'resolved' — The status of the Escalation
    - `subject` string — The subject of the Escalation
    - `subtype` string — An additional classifier for the escalation. The interpretation depends on the escalation type (e.g. an ISO country code for Unexpected Country Access escalations).
    - `type` string — The type of the Escalation
    - `updated_at` string, date-time — ISO-8601 formatted timestamp for when this escalation was last updated.
  - `pagination` Pagination, required — Pagination model
    - `next_page_url` string
    - `next_page_token` string

## Other responses

- `403` — There was an issue with your API credential or permissions.

---

[API](https://skmtc.net/huntress/apis/huntress-api-reference.md) · [All operations](https://skmtc.net/huntress/apis/huntress-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huntress/huntress-api-reference/revisions/94acb422c07d/schema)