---
title: "Get Incident"
description: "Returns the full detail of a single Incident Management incident: the incident row plus its alerts, timeline events, and role assignments."
---

`GET /api/im/incidents/:id`

Returns the full detail of a single incident: the incident row plus its alerts (a safe, redacted view, see below), timeline events in chronological order, and role assignments.

## Authentication

Same as [List Incidents](./list-incidents): any IM-eligible role (`admin`, `editor`, `responder`), or an organization-wide API token. Incident Management must be enabled for the organization.

## Example (cURL)

```bash
curl -X GET "$BASE_URL/api/im/incidents/42" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json"
```

## Response

```json
{
  "id": 42,
  "organizationId": 1,
  "teamId": 3,
  "title": "Database connection pool exhausted",
  "customerId": null,
  "primarySourceId": 7,
  "severity": "sev1",
  "severityManual": false,
  "status": "triggered",
  "mergedIntoId": null,
  "escalationPolicyId": 5,
  "currentTier": 1,
  "escalationEpoch": 0,
  "acknowledgedBy": null,
  "acknowledgedAt": null,
  "snoozedUntil": null,
  "autoResolve": true,
  "resolvedBy": null,
  "resolveNote": null,
  "createdBy": null,
  "sourceKind": "alert",
  "triggeredAt": "2026-07-17T09:12:00.000Z",
  "resolvedAt": null,
  "alerts": [
    {
      "id": 101,
      "organizationId": 1,
      "sourceId": 7,
      "dedupKey": "db-primary-01:pool-exhausted",
      "status": "open",
      "suppressedReason": null,
      "title": "Database connection pool exhausted",
      "severity": "sev1",
      "host": "db-primary-01",
      "mappedFields": {},
      "duplicateCount": 0,
      "firstSeenAt": "2026-07-17T09:12:00.000Z",
      "resolvedAt": null,
      "incidentId": 42
    }
  ],
  "events": [
    {
      "id": 501,
      "incidentId": 42,
      "at": "2026-07-17T09:12:00.000Z",
      "kind": "alert_received",
      "actorUserId": null,
      "payload": {}
    }
  ],
  "assignments": [
    {
      "id": 12,
      "userId": "u_abc123",
      "userName": "Jane Doe",
      "role": "commander",
      "createdAt": "2026-07-17T09:15:00.000Z"
    }
  ]
}
```

`alerts[].rawPayload` is never returned by this endpoint: the raw webhook/API payload can carry API keys or other secrets its source's operator put in it. It is also nulled server-side 90 days after ingest by a retention job. `alerts[].mappedFields` is the already-normalized, safe view of the same alert and survives retention.

**Retention, in full**: alert payloads (`rawPayload`) are nulled 90 days after ingest; resolved alerts are deleted 90 days after ingest; outbound-delivery (integration forwarding) records are deleted 90 days after they were sent. Per-source daily aggregates (alert/dedup/incident counts, as shown on a source's Analytics tab) are retained indefinitely. Deleting the underlying alert rows does not erase that history.

## Common errors

- `401 Unauthorized` when not authenticated
- `403 Forbidden` (`imAccessDenied`) when using a customer-scoped token, or a session without an IM-eligible role
- `403 Forbidden` (`imNotEnabled`) when Incident Management is not enabled for the organization
- `400 Bad Request` (`invalidRequestBody`) when `:id` is not a positive integer
- `404 Not Found` (`imIncidentNotFound`) when the incident does not exist, or belongs to another organization