---
title: "Create an Incident Report Resolution"
method: POST
path: "/v1/incident_reports/{id}/resolution"
tags: ["Incident Reports"]
---

# Create an Incident Report Resolution

`POST /v1/incident_reports/{id}/resolution`

Use this endpoint to resolve a single Incident Report. All remediations belonging to the Incident Report must be approved first.

While resolution updates the report status to resolved, assisted remediations may still be running in the background and manual remediations may still require completion by a user.

This endpoint requires an API key with permissions to resolve incident reports. **Note that the default account API key is read-only, so you'll need to create a user-based API key with the appropriate permissions to access this endpoint**.

## Path parameters

- `id` integer, required

## Response `201`

Create an Incident Report Resolution

- object
  - `incident_report` IncidentReport — IncidentReport model
    - `id` integer — A unique identifier for an incident report.
    - `account_id` integer — Unique identifier for the account this incident report is associated with.
    - `agent_id` integer — Unique identifier for the agent this incident report is associated with.
    - `body` string — Autogenerated content describing the details of the incident in question.
    - `closed_at` string, date-time — ISO-8601 formatted timestamp for when this incident report had its status set to `closed`. Null if non-applicable.
    - `indicator_counts` object — Mapping of indicator types to number of incidences of that threat in the context of this incident report.
    - `indicator_types` string[] — Unique list of threat indicators that have been found in the context of this incident report.
    - `organization_id` integer — Unique identifier for the organization this incident report is associated with.
    - `platform` string — The platform of the host machine (`darwin`,`google`,`microsoft_365`,`linux`,`windows`, or `other`).
    - `remediations` object — This represents an itemized list of the first 10 remediations for an incident report. If there are more than 10, use the remediations endpoint to retrieve information about them.
    - `sent_at` string, date-time — ISO-8601 formatted timestamp for when a Huntress SOC analyst has notified necessary parties regarding this incident report. Null if not sent.
    - `severity` string — The severity of the incident report. Can be one of `low`, `high`, `critical`.
    - `status` string — Status of the incident report. Can be one of `sent`, `closed`, `dismissed`
    - `status_updated_at` string, date-time — ISO-8601 formatted timestamp for when the status of this incident report was last updated.
    - `subject` string — Autogenerated one-line description of the incident.
    - `summary` string — Details of the incident report, as provided by a Huntress SOC analyst.
    - `updated_at` string, date-time — ISO-8601 formatted timestamp for when this incident report was last updated.

## Other responses

- `403` — There was an issue with your API credential or permissions.
- `409` — Incident Report cannot be resolved. Confirm that all remediations are approved and report status is 'sent'.
- `422` — Incident Report cannot be resolved unless report status is 'sent'.

---

[API](https://skmtc.net/huntress/apis/huntress-api-reference.md) · [All operations](https://skmtc.net/huntress/apis/huntress-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huntress/huntress-api-reference/revisions/94acb422c07d/schema)