get
/v4/Incidents
Current limitation: the total results count value will always be null unless the _IsRecipient_ filter is set.
Returns a list of incidents based on privileges assigned to the authenticated Security Center user and filters specified in the query parameters.
CURL
curl -X GET \
-H "Accept: application/json" \
"http://localhost/v4/Incidents?expand=expand_example&dateTimeFrom=2013-10-20T19:20:30+01:00&dateTimeTo=2013-10-20T19:20:30+01:00&isRecipient=true&incidentTypeIds=&locationIds=&ownerIds=&priorityIds=&stateIds=&additionalFields=&showEligibility=true&offset=56&limit=56&sortBy=sortBy_example"
Query parameters
expand
optional
String
This query parameter allows you to retrieve sub-resources immediately instead of retrieving them in a separate request.
It is possible to expand multiple properties by delimiting them with commas, or specifying "all" to expand all sub-resources.
For the list of expandable sub-resources, please consult the Incident model in the Models section.
Example:
expand_example
dateTimeFrom
optional
Object
format: date-time
This query parameter allows you to retrieve incidents that were triggered after the provided date.
You can specify date in either of the following formats:
You can specify date in either of the following formats:
- Local date and time format: yyyy-mm-dd hh:mm:ss
- UTC format: yyyy-mm-ddThh:mm:ssZ
Example:
2013-10-20T19:20:30+01:00
dateTimeTo
optional
Object
format: date-time
This query parameter allows you to retrieve incidents that were triggered before the provided date.
You can specify date in either of the following formats:
You can specify date in either of the following formats:
- Local date and time format: yyyy-mm-dd hh:mm:ss
- UTC format: yyyy-mm-ddThh:mm:ssZ
Example:
2013-10-20T19:20:30+01:00
isRecipient
optional
Boolean
This query parameter allows you to retrieve incidents for which you are a recipient or a supervisor
You must specify either 'true' or 'false'.
Note: User cannot enable IsRecipient filter and Closed state filter at the same time.
You must specify either 'true' or 'false'.
Note: User cannot enable IsRecipient filter and Closed state filter at the same time.
Example:
true
incidentTypeIds
optional
Array
of strings
(UUID)
format: uuid
This query parameter allows you to retrieve incidents that match the incident type identifier (the available types can be retrieved from a separate endpoint).
It is possible to provide a list of identifiers by delimiting them with commas. format: uuid
It is possible to provide a list of identifiers by delimiting them with commas. format: uuid
locationIds
optional
Array
of strings
(UUID)
format: uuid
This query parameter allows you to retrieve incidents that match the location identifier.
It is possible to provide a list of identifiers by delimiting them with commas. format: uuid
It is possible to provide a list of identifiers by delimiting them with commas. format: uuid
ownerIds
optional
Array
of strings
(UUID)
format: uuid
This query parameter allows you to retrieve incidents that match the user identifier.
It is possible to provide a list of identifiers by delimiting them with commas. format: uuid
It is possible to provide a list of identifiers by delimiting them with commas. format: uuid
priorityIds
optional
Array
of strings
(UUID)
format: uuid
This query parameter allows you to retrieve incidents that match the incident priority identifier (the available priorities can be retrieved from a separate endpoint).
It is possible to provide a list of identifiers by delimiting them with commas. format: uuid
It is possible to provide a list of identifiers by delimiting them with commas. format: uuid
stateIds
optional
Array
of strings
(UUID)
format: uuid
This query parameter allows you to retrieve incidents that match the incident state identifier (the available states can be retrieved from a separate endpoint).
It is possible to provide a list of identifiers by delimiting them with commas.
Note: Users must have the Third-party integration mode privilege or the Incident report privilege. format: uuid
It is possible to provide a list of identifiers by delimiting them with commas.
Note: Users must have the Third-party integration mode privilege or the Incident report privilege. format: uuid
additionalFields
optional
Array
of strings
This query parameter allows you to retrieve incidents that matches every single additional field filter (each string item is a different field).
The syntax we use to retrieve the additional field is in a LHS format with the fieldName, compare mode and value as the required information.
Format: fieldName[compareMode]=value
Note: Using box brackets([ ]) or the equal sign(=) as characters in the fieldName or value will break the LHS format.
Compare Mode with data type:
String and URL - Equals, NotEquals, Contains, DoesNotContain, StartsWith, DoesNotStartWith, EndsWith, DoesNotEndWith
Number - Equals, NotEquals, GreaterThan, GreaterThanOrEquals, LessThan, LessThanOrEquals
Boolean - Equals, NotEquals
Examples:
Name[Equals]=John (Retrieving every incident that has John as value for field name).
NumberOfPeople[GreaterThan]=5 (Retrieving every incident that has more than 5 as value for field NumberOfPeople).
The syntax we use to retrieve the additional field is in a LHS format with the fieldName, compare mode and value as the required information.
Format: fieldName[compareMode]=value
Note: Using box brackets([ ]) or the equal sign(=) as characters in the fieldName or value will break the LHS format.
Compare Mode with data type:
String and URL - Equals, NotEquals, Contains, DoesNotContain, StartsWith, DoesNotStartWith, EndsWith, DoesNotEndWith
Number - Equals, NotEquals, GreaterThan, GreaterThanOrEquals, LessThan, LessThanOrEquals
Boolean - Equals, NotEquals
Examples:
Name[Equals]=John (Retrieving every incident that has John as value for field name).
NumberOfPeople[GreaterThan]=5 (Retrieving every incident that has more than 5 as value for field NumberOfPeople).
showEligibility
optional
Boolean
Example:
true
offset
optional
Object
format: int32
This query parameter allows you to set the number of items to be skipped.
The default value for this parameter is 0. format: int32
The default value for this parameter is 0. format: int32
Example:
56
limit
optional
Object
format: int32
This query parameter allows you to set the number of items to retrieve. Maximum value: 100.
The default value for this parameter is 25. format: int32
The default value for this parameter is 25. format: int32
Example:
56
sortBy
optional
String
This query parameter allows you to sort the incident list based on specific incident properties defined in the Models page of this documentation.
You can specify the sort preference in the following format: IncidentProperty.OrderParameter.
The IncidentProperty should be replaced by one of the values from the IncidentSortingProperties enum defined in the Models page of this documentation.
The OrderParameter should be replaced by one the following values:
The default value is displayId.desc.
Example:
sortBy_example
Responses