---
title: "Get Incident Activity Log"
method: GET
path: "/v1/incidents/{incident-id}/activity"
tags: ["Incidents"]
---

# Get Incident Activity Log

`GET /v1/incidents/{incident-id}/activity`

Retrieve incident activity log, newest first.

## Path parameters

- `incident-id` integer, required

## Response `200`

Successful retrieval of activity log.

- IncidentActivityEntry[]
  - `id` integer — Unique activity entry identifier.
  - `incidentId` integer — ID of incident the entry belongs to.
  - `timestamp` string, date-time — Time the activity was recorded.
  - `userId` integer — ID of user who performed the action, or 0 if performed by the server itself.
  - `userName` string — Login name of user who performed the action. Actions performed by the server itself (for example, incident creation by an event processing rule) carry user ID 0 and resolve to the built-in "system" account.
  - `activityType` integer — Activity type: 0 created, 1 state change, 2 assigned, 3 alarm linked, 4 alarm unlinked, 5 comment added, 6 updated.
  - `oldValue` string, nullable — Value before the change, if applicable.
  - `newValue` string, nullable — Value after the change, if applicable.
  - `details` string, nullable — Additional details, if any.

## Other responses

- `401` — Unauthorized
- `403` — User does not have read access to incident's source object
- `404` — Incident with given ID does not exist

---

[API](https://skmtc.net/netxms/apis/netxms-api.md) · [All operations](https://skmtc.net/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netxms/netxms-api/revisions/d2e5c5ea6e4c/schema)