---
title: "Get raw data - multiple incidents"
method: POST
path: "/analytics/raw/incidents"
tags: ["Analytics"]
---

# Get raw data - multiple incidents

`POST /analytics/raw/incidents`

Provides enriched incident data and metrics for multiple incidents.

Example metrics include Seconds to Resolve, Seconds to Engage, Snoozed Seconds, and Sleep Hour Interruptions. Metric definitions can be found in our [Knowledge Base](https://support.pagerduty.com/docs/insights#incidents-list).

<!-- theme: info -->
> A `team_ids` or `service_ids` filter is required for [user-level API keys](https://support.pagerduty.com/docs/using-the-api#section-generating-a-personal-rest-api-key) or keys generated through an OAuth flow. Account-level API keys do not have this requirement.
<!-- theme: info -->
> **Note:** Data availability reflects [pipeline processing cycles](https://support.pagerduty.com/main/docs/insights#:~:text=Data%20Update%20Schedule) and is generally within 24 hours under normal conditions.

Scoped OAuth requires: `analytics.write`

## Headers

- `Accept` string, required
- `Content-Type` 'application/json', required

## Request body

- object
  - `filters` object — Filters the result, only show incidents that match the conditions passed in the filter.
    - `created_at_start` string — Filters the result, showing only the incidents where the creation timestamp is greater than or equal to the filter value.
    - `created_at_end` string — Filters the result, showing only the incidents where the creation timestamp is less than the filter value.
    - `updated_after` string — Filters the result, showing only incidents where the updated_at value is greater than the filter value.
    - `urgency` string — Filters the result, showing only the incidents where urgency matches the filter value.
    - `major` boolean — An incident is classified as a [major incident](https://support.pagerduty.com/docs/operational-reviews#major-incidents) if it has one of the two highest priorities, or if multiple responders are added and acknowledge the incident.
    - `team_ids` string[] — An array of team IDs. Only incidents that are assigned to a member of these teams will be returned. Account must have the teams ability to use this parameter.
    - `service_ids` string[] — An array of service IDs. Only results related to these services will be returned.
    - `priority_ids` string[] — The priority_ids filter applied to the results.
    - `priority_names` string[] — The priority_names filter applied to the results.
    - `incident_type_ids` string[] — Filter incidents by specific incident type IDs. Only incidents matching the given IDs will be returned.
  - `starting_after` string — A cursor to indicate the reference point that the results should follow
  - `ending_before` string — A cursor to indicate the reference point that the results should precede
  - `order` 'asc' | 'desc' — The order the results; asc for ascending, desc for descending. Defaults to 'desc'.
  - `order_by` 'created_at' | 'seconds_to_resolve' — The column to use for ordering the results. Defaults to 'created_at'.
  - `limit` integer — Number of results to include in each batch. Limits between 1 to 1000 are accepted.
  - `time_zone` string — The time zone to use for the results.

## Response `200`

OK

- object
  - `first` string, required — Cursor to identify the first object in the response.
  - `last` string, required — Cursor to identify the last object in the response.
  - `limit` integer, required — Number of results to include in the batch.
  - `more` boolean, required — Indicates if there are more resources available than were returned.
  - `order` 'asc' | 'desc', required — The order in which the results were sorted; asc for ascending, desc for descending.
  - `order_by` 'created_at' | 'seconds_to_resolve' | 'updated_at', required — The column that was used for ordering the results.
  - `filters` object — A collection of filters that were applied to the results.
    - `created_at_start` string — The lower boundary for the created_at range filter applied to the results.
    - `created_at_end` string — The upper boundary for the created_at range filter applied to the results.
    - `urgency` 'high' | 'low' — The urgency filter applied to the results.
    - `major` boolean — The [major incident](https://support.pagerduty.com/docs/operational-reviews#major-incidents) filter applied to the results.
    - `team_ids` string[] — The team_ids filter applied to the results.
    - `service_ids` string[] — The service_ids filter applied to the results.
    - `priority_ids` string[] — The priority_ids filter applied to the results.
    - `priority_names` string[] — The priority_names filter applied to the results.
    - `incident_type_ids` string[] — The incident_type_ids filter applied to the results.
  - `time_zone` string, required — The time zone that the results are in.
  - `data` AnalyticsRawIncident[], required
    - `acknowledged_user_ids` string[] — The IDs of the users who acknowledged the incident.
    - `acknowledged_user_names` string[] — The names of the users who acknowledged the incident.
    - `acknowledgement_count` integer — Total count of acknowledgements in the incident.
    - `active_user_count` integer — Total number of responders who either acknowledged the incident or accepted a responder request.
    - `assigned_user_ids` string[] — The IDs of the users who were assigned the incident.
    - `assigned_user_names` string[] — The names of the users who were assigned the incident.
    - `assignment_count` integer — Total count of instances where responders were assigned an incident (including through reassignment or escalation).
    - `auto_resolved` boolean — Whether or not the incident resolved automatically, either via an integration or [auto-resolved in PagerDuty](https://support.pagerduty.com/docs/configurable-service-settings#auto-resolution).
    - `business_hour_interruptions` integer — Total number of unique interruptions during business hours; 8am-6pm Mon-Fri, based on the user’s time zone.
    - `created_at` string — Timestamp of when the incident was created.
    - `updated_at` string — Timestamp of when the incident was last updated by the analytics process. Does not match the updated_at for an incident returned by the standard REST api incidents endpoint.
    - `description` string — The incident description
    - `engaged_seconds` integer — Total engaged time across all responders for this incident. Engaged time is measured from the time a user engages with an incident (by acknowledging or accepting a responder request) until the incident is resolved. This may include periods in which the incidents were snoozed.
    - `engaged_user_count` integer — Total number of users who engaged (acknowledged, accepted responder request) in the incident.
    - `escalation_count` integer — Total count of instances where an incident is escalated between responders assigned to an escalation policy.
    - `escalation_policy_id` string — ID of the escalation policy the incident was assigned to.
    - `escalation_policy_name` string — Name of the escalation policy the incident was assigned to.
    - `id` string — Incident ID
    - `incident_number` integer — The PagerDuty incident number.
    - `incident_type_id` string — ID of the Incident Type.
    - `incident_type_name` string — The name of the Incident Type.
    - `joined_user_ids` string[] — The IDs of the users who either acknowledged the incident or accepted a responder request.
    - `joined_user_names` string[] — The names of the users who either acknowledged the incident or accepted a responder request.
    - `major` boolean — An incident is classified as a [major incident](https://support.pagerduty.com/docs/operational-reviews#major-incidents) if it has one of the two highest priorities, or if multiple responders are added and acknowledge the incident.
    - `manual_escalation_count` integer — Total count of manual escalations in the incident.
    - `off_hour_interruptions` integer — Total number of unique interruptions during off hours; 6pm-10pm Mon-Fri and all day Sat-Sun, based on the user’s time zone.
    - `priority_id` string, nullable — ID of the incident's priority level.
    - `priority_name` string, nullable — The user-provided short name of the priority.
    - `priority_order` integer, nullable — The numerical value used to sort priorities. Higher values are higher priority.
    - `reassignment_count` integer — Total count of reassignments in the incident.
    - `resolved_at` string — Timestamp of when the incident was resolved.
    - `resolved_by_user_id` string — ID of the user who resolved the incident.
    - `resolved_by_user_name` string — Name of the user who resolved the incident.
    - `seconds_to_engage` integer — A measure of *people response time*. This metric measures the time from the first user engagement (acknowledge or responder accept) to the last. This metric is only used for incidents with **multiple responders**; for incidents with one or no engaged users, this value is null.
    - `seconds_to_first_ack` integer — Time between the start of an incident, and the first responder to acknowledge.
    - `seconds_to_mobilize` integer — Time between the start of an incident, and the last additional responder to acknowledge. If an incident has one or no responders, the value will be null.
    - `seconds_to_resolve` integer — Time from when an incident was triggered until it was resolved.
    - `service_id` string — ID of the service that the incident triggered on.
    - `service_name` string — Name of the service that the incident triggered on.
    - `sleep_hour_interruptions` integer — Total number of unique interruptions during sleep hours; 10pm-8am every day, based on the user’s time zone.
    - `snoozed_seconds` integer — Total seconds the incident has been snoozed for.
    - `status` string — The incident status. Can be one of `triggered`, `acknowledged`, or `resolved`.
    - `team_id` string, nullable — ID of the team the incident was assigned to.
    - `team_name` string, nullable — Name of the team the incident was assigned to.
    - `timeout_escalation_count` integer — Total count of timeout escalations in the incident.
    - `total_interruptions` integer — Total number of unique interruptions in the incident.
    - `total_notifications` integer — Total number of notifications sent for the incident.
    - `urgency` string — Notification level
    - `user_defined_effort_seconds` integer, nullable — The total response effort in seconds, [as defined by the user](https://support.pagerduty.com/docs/editing-incidents#edit-incident-duration).

## Other responses

- `400` — Caller provided invalid arguments. Please review the response for error details. Retrying with the same arguments will *not* work.
- `429` — Too many requests have been made, the rate limit has been reached.

---

[API](https://skmtc.net/pagerduty/apis/rest-api.md) · [All operations](https://skmtc.net/pagerduty/apis/rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pagerduty/rest-api/revisions/b679a8f3f02c/schema)