---
title: "Search Incidents"
method: POST
path: "/incident/v1/incidents/search"
tags: ["Incidents"]
---

# Search Incidents

`POST /incident/v1/incidents/search`

Use this API to search for incidents by key terms and filters.

## Query parameters

- `page` integer
- `size` integer
- `sort` 'createdDate,asc' | 'createdDate,desc' | 'name,asc' | 'name,desc'

## Request body

- SearchCriteriaInformation — unresolved $ref

## Response `200`

OK

- IncidentListInformation[]
  - `incidentId` string, uuid — Incident Identifier
  - `number` integer — Incident Number
  - `incidentTypeId` string, uuid — The unique identifier for the incident type.
  - `incidentTypeName` string — The name of the incident type.
  - `description` string — Incident Description
  - `sourceType` 'MANUAL' | 'ASSESSMENT' | 'WEBFORM' | 'NONE' | 'INTEGRATION' — Creation Source
  - `orgGroupId` string, uuid — Organization Group Id
  - `orgGroupName` string — Organization Group Name
  - `dateOccurred` string, date-time — The date and time when the incident occurred, represented as an ISO 8601 timestamp in UTC.
  - `dateClosed` string, date-time — The date and time when the incident was closed, represented as an ISO 8601 timestamp in UTC.
  - `dateDiscovered` string, date-time — The date and time when the incident was discovered, represented as an ISO 8601 timestamp in UTC.
  - `deadline` string, date-time — The date by which the incident investigation or notification must be completed, represented as an ISO 8601 timestamp in UTC.
  - `assigneeName` string — Incident User Assignee Name
  - `totalAssessment` integer — Count of Assessment Linked to this Incident
  - `isExtended` boolean — Indicates whether the notification deadline has been extended.
  - `isDeleted` boolean — Indicates whether the incident has been deleted.
  - `createdBy` string, uuid — Incident Created User Id.
  - `creator` string — Incident Created User Name
  - `createdDate` string, date-time — The date and time when the incident was created, represented as an ISO 8601 timestamp in UTC.
  - `name` string — Incident Name
  - `openAssessment` integer — Count of Open Assessments Linked to this Incident
  - `workflowId` string, uuid — Incident Workflow Id
  - `workflowName` string — Incident Workflow Name.
  - `incidentStageId` string, uuid — Incident Stage Id
  - `incidentStageName` string — Incident Stage Name
  - `incidentStageBadgeColor` string — The badge color of the incident workflow stage.
  - `notificationNeeded` 'YES' | 'NO' | 'UNKNOWN' — Incident Notification Needed
  - `incidentStatus` 'OPEN' | 'CLOSED' — Incident Status
  - `attributeValues` object — Custom Attributes

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `429` — Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).
- `500` — Internal Server Error

---

[API](https://skmtc.net/onetrust/apis/platform-access-management.md) · [All operations](https://skmtc.net/onetrust/apis/platform-access-management/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onetrust/platform-access-management/revisions/21de3aa0b170/schema)