---
title: "List Incident Reports"
method: GET
path: "/v1/incident_reports"
tags: ["Incident Reports"]
---

# List Incident Reports

`GET /v1/incident_reports`

Shows Incident Reports associated with your account.

**Note:** This endpoint will also return a `pagination` key on the root level.  
Please refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.

## Query parameters

- `limit` integer
- `page_token` string
- `sort_field` 'id' | 'created_at' | 'updated_at'
- `sort_direction` 'asc' | 'desc'
- `indicator_type` 'footholds' | 'monitored_files' | 'ransomware_canaries' | 'antivirus_detections' | 'process_detections' | 'managed_identity' | 'mde_detections' | 'siem_detections' | 'favicon_detections' | 'behavioral_detections' | 'email_security_detections' | 'app_control' | 'ai_misuse'
- `status` 'sent' | 'closed' | 'dismissed' | 'auto_remediating' | 'deleting' | 'partner_dismissed'
- `severity` 'low' | 'high' | 'critical'
- `platform` 'windows' | 'darwin' | 'microsoft_365' | 'google' | 'linux' | 'email_security' | 'other'
- `organization_id` integer
- `agent_id` integer

## Response `200`

List Incident Reports

- object
  - `incident_reports` IncidentReport[], required
    - `id` integer — A unique identifier for an incident report.
    - `account_id` integer — Unique identifier for the account this incident report is associated with.
    - `agent_id` integer — Unique identifier for the agent this incident report is associated with.
    - `body` string — Autogenerated content describing the details of the incident in question.
    - `closed_at` string, date-time — ISO-8601 formatted timestamp for when this incident report had its status set to `closed`. Null if non-applicable.
    - `indicator_counts` object — Mapping of indicator types to number of incidences of that threat in the context of this incident report.
    - `indicator_types` string[] — Unique list of threat indicators that have been found in the context of this incident report.
    - `organization_id` integer — Unique identifier for the organization this incident report is associated with.
    - `platform` string — The platform of the host machine (`darwin`,`google`,`microsoft_365`,`linux`,`windows`, or `other`).
    - `remediations` object — This represents an itemized list of the first 10 remediations for an incident report. If there are more than 10, use the remediations endpoint to retrieve information about them.
    - `sent_at` string, date-time — ISO-8601 formatted timestamp for when a Huntress SOC analyst has notified necessary parties regarding this incident report. Null if not sent.
    - `severity` string — The severity of the incident report. Can be one of `low`, `high`, `critical`.
    - `status` string — Status of the incident report. Can be one of `sent`, `closed`, `dismissed`
    - `status_updated_at` string, date-time — ISO-8601 formatted timestamp for when the status of this incident report was last updated.
    - `subject` string — Autogenerated one-line description of the incident.
    - `summary` string — Details of the incident report, as provided by a Huntress SOC analyst.
    - `updated_at` string, date-time — ISO-8601 formatted timestamp for when this incident report was last updated.
  - `pagination` Pagination, required — Pagination model
    - `next_page_url` string
    - `next_page_token` string

## Other responses

- `403` — There was an issue with your API credential or permissions.

---

[API](https://skmtc.net/huntress/apis/huntress-api-reference.md) · [All operations](https://skmtc.net/huntress/apis/huntress-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huntress/huntress-api-reference/revisions/94acb422c07d/schema)