latestSwagger 2.02026-08-109450223.9 KB

94acb422c07d

Incident Reports

List Remediations

Shows details of Remediations belonging to a single Incident Report.

Note: This endpoint will also return a pagination key on the root level.
Please refer to the pagination section within our docs for more information.

get/v1/incident_reports/{incident_report_id}/remediations

Path parameters

incident_report_idinteger required

Query parameters

limitinteger

Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.

page_tokenstring

Token used to request the next page in paginated results. Defaults to 'null'

sort_field'id' | 'created_at' | 'updated_at'

Field to sort by. Defaults to 'id'.

sort_direction'asc' | 'desc'

Sort direction. Defaults to 'desc'.

types[]string[]

Filter by type of remediation. Must be a comma-separated string containing the values: assisted, manual, containment

statuses[]string[]

Filter by status of remediation. Must be a comma-separated string containing the values: unapproved, approved, completed, failed, cancelled

Response

List Remediations

Example response

{
  "remediations": [
    {
      "id": 1,
      "type": "manual",
      "action": "Delete File",
      "parameters": [
        {
          "name": "path",
          "description": "c:\\windows\\system32\\tasks\\malicious_task"
        }
      ],
      "status": "completed",
      "approved_at": "2025-06-26T18:57:03Z",
      "approved_by": {
        "id": 1,
        "email": "john.smith@example.com",
        "name": "John Smith"
      },
      "completed_at": "2025-06-26T18:57:03Z"
    }
  ]
}