Sign in
Incidents

Search Incidents

Use this API to search for incidents by key terms and filters.

post/incident/v1/incidents/search

Query parameters

pageinteger

Page number (0-based index)

sizeinteger

Number of records per page

sort'createdDate,asc' | 'createdDate,desc' | 'name,asc' | 'name,desc'

Sort criteria in the format: property,(asc|desc)

Request body

SearchCriteriaInformation required— unresolved $ref

Response

OK

incidentIdstring uuid

Incident Identifier

numberinteger

Incident Number

incidentTypeIdstring uuid

The unique identifier for the incident type.

incidentTypeNamestring

The name of the incident type.

descriptionstring

Incident Description

sourceType'MANUAL' | 'ASSESSMENT' | 'WEBFORM' | 'NONE' | 'INTEGRATION'

Creation Source

orgGroupIdstring uuid

Organization Group Id

orgGroupNamestring

Organization Group Name

dateOccurredstring date-time

The date and time when the incident occurred, represented as an ISO 8601 timestamp in UTC.

dateClosedstring date-time

The date and time when the incident was closed, represented as an ISO 8601 timestamp in UTC.

dateDiscoveredstring date-time

The date and time when the incident was discovered, represented as an ISO 8601 timestamp in UTC.

deadlinestring date-time

The date by which the incident investigation or notification must be completed, represented as an ISO 8601 timestamp in UTC.

assigneeNamestring

Incident User Assignee Name

totalAssessmentinteger

Count of Assessment Linked to this Incident

isExtendedboolean

Indicates whether the notification deadline has been extended.

isDeletedboolean

Indicates whether the incident has been deleted.

createdBystring uuid

Incident Created User Id.

creatorstring

Incident Created User Name

createdDatestring date-time

The date and time when the incident was created, represented as an ISO 8601 timestamp in UTC.

namestring

Incident Name

openAssessmentinteger

Count of Open Assessments Linked to this Incident

workflowIdstring uuid

Incident Workflow Id

workflowNamestring

Incident Workflow Name.

incidentStageIdstring uuid

Incident Stage Id

incidentStageNamestring

Incident Stage Name

incidentStageBadgeColorstring

The badge color of the incident workflow stage.

notificationNeeded'YES' | 'NO' | 'UNKNOWN'

Incident Notification Needed

incidentStatus'OPEN' | 'CLOSED'

Incident Status

attributeValuesobject

Custom Attributes

Example response

[
  {
    "incidentId": "1d429adf-26c5-413b-9b01-e7845a5dde99",
    "number": 1,
    "incidentTypeName": "Misdirected Email",
    "description": "An employee accessed a restricted HR file without proper authorization.\nAccess logs confirmed the breach, and the user’s permissions were immediately revoked.\n",
    "sourceType": "INTEGRATION",
    "orgGroupName": "Business Unit",
    "dateOccurred": "2025-04-01T12:43:24.173Z",
    "dateClosed": "2025-04-03T12:43:24.173Z",
    "dateDiscovered": "2025-04-02T12:43:24.173Z",
    "deadline": "2025-04-03T12:43:24.173Z",
    "assigneeName": "User Name",
    "creator": "User Name",
    "createdDate": "2025-04-02T13:00:00.173Z",
    "name": "Joe sent an email to the wrong client",
    "openAssessment": 1,
    "workflowName": "Default Workflow",
    "incidentStageName": "Investigating",
    "incidentStageBadgeColor": "InProgress",
    "notificationNeeded": "UNKNOWN",
    "incidentStatus": "OPEN",
    "attributeValues": {
      "customTextAttributeFieldName": [
        {
          "value": "Attribute Value",
          "disabled": false
        }
      ],
      "customSingleSelectAttributeFieldName": [
        {
          "id": "0f5afc29-7fe1-4145-b541-ac33158312b6",
          "value": "Option Value 1",
          "disabled": false
        }
      ],
      "customMultiSelectAttributeFieldName": [
        {
          "id": "736a8cb4-4e0e-4938-a43f-74edbaf46c0a",
          "value": "Option Value 2",
          "disabled": false
        },
        {
          "id": "b4e17ed9-5e11-44f8-bb20-100af4d9e39b",
          "value": "Option Value 3",
          "disabled": false
        }
      ]
    }
  }
]