---
title: "Get Incident Details"
method: GET
path: "/v1/incidents/{incident-id}"
tags: ["Incidents"]
---

# Get Incident Details

`GET /v1/incidents/{incident-id}`

Retrieve full incident details, including linked alarm IDs and comments.

## Path parameters

- `incident-id` integer, required

## Response `200`

Successful retrieval of incident.

- Incident — Full incident details
  - `id` integer — Unique incident identifier.
  - `state` integer — Incident state: 0 open, 1 in progress, 2 blocked, 3 resolved, 4 closed.
  - `stateName` string — Human-readable incident state name.
  - `title` string — Incident title (up to 255 characters).
  - `sourceObjectId` integer — ID of object the incident was created on.
  - `sourceObjectName` string — Name of the source object.
  - `assignedUserId` integer — ID of user the incident is assigned to, or 0 when unassigned.
  - `assignedUserName` string — Login name of assigned user. Unassigned incidents must be detected by testing assignedUserId for 0, not by matching on this name - user ID 0 resolves to the built-in "system" account.
  - `alarmCount` integer — Number of alarms linked to the incident.
  - `creationTime` string, date-time — Incident creation time.
  - `lastChangeTime` string, date-time — Time of last incident change.
  - `sourceAlarmId` integer — ID of alarm the incident was created from, or 0 if created manually.
  - `createdByUser` integer — ID of user who created the incident, or 0 when created by event processing rule.
  - `createdByUserName` string — Login name of creating user. Resolves to the built-in "system" account when the incident was created by an event processing rule.
  - `resolvedByUser` integer — ID of user who resolved the incident, or 0 if not resolved yet.
  - `resolvedByUserName` string — Login name of resolving user. Meaningful only when resolvedByUser is not 0.
  - `resolveTime` string, date-time, nullable — Time the incident was resolved, or null if not resolved yet.
  - `closedByUser` integer — ID of user who closed the incident, or 0 if not closed yet.
  - `closedByUserName` string — Login name of closing user. Meaningful only when closedByUser is not 0.
  - `closeTime` string, date-time, nullable — Time the incident was closed, or null if not closed yet.
  - `linkedAlarms` integer[] — IDs of alarms linked to the incident.
  - `comments` IncidentComment[] — Incident comments, oldest first.
    - `id` integer — Unique comment identifier.
    - `incidentId` integer — ID of incident the comment belongs to.
    - `userId` integer — ID of user who added the comment, or 0 for comments added by the server itself.
    - `userName` string — Login name of user who added the comment. Comments added by the server itself (AI analysis, event processing rules) carry user ID 0 and resolve to the built-in "system" account; use aiGenerated to identify AI-authored comments.
    - `creationTime` string, date-time — Comment creation time.
    - `text` string — Comment text.
    - `aiGenerated` boolean — True if the comment was generated by AI analysis.

## Other responses

- `401` — Unauthorized
- `403` — User does not have read access to incident's source object
- `404` — Incident with given ID does not exist

---

[API](https://skmtc.net/netxms/apis/netxms-api.md) · [All operations](https://skmtc.net/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netxms/netxms-api/revisions/ae3bfc65fa61/schema)