List Incidents

GET /api/im/incidents

Returns a filtered list of incidents for your organization, newest first (triggeredAt descending, then id descending). Each item carries the incident's own fields plus a small, page-level enrichment: the primary assignee, the people on the lifecycle columns, and the incident's alert activity (see Resolved people below). An incident's full alerts, timeline events, and assignments are available on the Get Incident endpoint.

AuthenticationCopy Anchor Link

Any IM-eligible role (admin, editor, responder) or an organization-wide API token, see Authentication. Incident Management must be enabled for the organization.

Query ParametersCopy Anchor Link

A repeatable parameter accepts a repeated query key, e.g. status=triggered&status=acknowledged. For single-value parameters, the last occurrence wins.

Example (cURL)Copy Anchor Link

Cursor mode:

curl -X GET "$BASE_URL/api/im/incidents?status=triggered&status=acknowledged&severity=sev1&limit=25&envelope=items" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json"

Page mode, second page with a frozen result set:

curl -X GET "$BASE_URL/api/im/incidents?page=2&limit=25&asOf=2026-07-17T10:00:00.000Z&envelope=items" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json"

ResponseCopy Anchor Link

{
  "items": [
    {
      "id": 42,
      "organizationId": 1,
      "teamId": 3,
      "title": "Database connection pool exhausted",
      "customerId": null,
      "primarySourceId": 7,
      "severity": "sev1",
      "severityManual": false,
      "status": "acknowledged",
      "mergedIntoId": null,
      "escalationPolicyId": null,
      "currentTier": null,
      "escalationEpoch": 1,
      "escalationCycle": 0,
      "acknowledgedBy": "MFcTjWmYq2LpzR8vK1sXo",
      "acknowledgedAt": "2026-07-17T09:15:31.000Z",
      "snoozedUntil": null,
      "autoResolve": true,
      "resolvedBy": null,
      "resolveNote": null,
      "statuspageUpdate": null,
      "createdBy": null,
      "sourceKind": "alert",
      "isTest": false,
      "category": null,
      "isNearMiss": false,
      "triggeredAt": "2026-07-17T09:12:00.000Z",
      "resolvedAt": null,
      "serviceId": 4,
      "assignee": {
        "userId": "MFcTjWmYq2LpzR8vK1sXo",
        "name": "Grace Hopper",
        "role": "commander",
        "image": "/api/assets/avatar/MFcTjWmYq2LpzR8vK1sXo"
      },
      "createdByUser": null,
      "acknowledgedByUser": {
        "userId": "MFcTjWmYq2LpzR8vK1sXo",
        "name": "Grace Hopper",
        "image": "/api/assets/avatar/MFcTjWmYq2LpzR8vK1sXo"
      },
      "resolvedByUser": null,
      "lastAlertAt": "2026-07-17T09:41:00.000Z",
      "alertDuplicateCount": 3,
      "host": "db-2.example.com:5432"
    }
  ],
  "nextCursor": "1752743520000:42",
  "hasMore": true
}

nextCursor is null on the last page. In cursor mode, pass it back as the cursor query parameter to fetch the next page.

In page mode (page set) the response additionally carries total (the number of incidents matching all filters and asOf) and asOf (the frozen cut-off as ISO 8601). Without page, neither field is present.

List form: with envelope=items every response also carries hasMore (false on the last page), and page mode adds page and perPage (the effective limit) next to total and asOf. Without it the endpoint still answers the current form ({ items, nextCursor }, in page mode plus total and asOf), which is deprecated; the list form becomes the default on 2027-01-18.

lastAlertAt is the newest alert-shaped timeline event for the incident (null when it has none), and alertDuplicateCount is the number of repeat firings its alerts absorbed through deduplication. Neither touches an incident column, which is why they are reported separately.

host names the system the incident is about: the host of its newest alert that carried one (a website URL, hostname:port of a server monitor, a domain, a Zabbix host). null when no alert named one, e.g. a manually created incident.

Field notes: sourceKind is alert, manual or api. isTest marks an incident raised from a test page. category (availability, security, other or null) and isNearMiss are the NIS-2 classification, see Classify Incident. escalationPolicyId is no longer used and is always null on new incidents; the escalation chain is resolved from the team's escalation tiers.

Resolved peopleCopy Anchor Link

assignee is the incident's primary role holder (commander beats tech_lead beats comms beats assignee), or null when nobody holds a role on it.

createdByUser, acknowledgedByUser and resolvedByUser are the people behind the createdBy, acknowledgedBy and resolvedBy user ids on the same row. Each is null when the corresponding id is null.

Every one of these is resolved server-side in one batched, organization-scoped lookup for the whole page:

• name is the person's display name. Only an organization admin (and therefore a normal organization-wide API token) gets the e-mail address as a fallback when the profile carries no name; for every other role name is null in that case.
• name is null when the id belongs to a user outside your organization, for example a platform administrator acting across tenants, or an account that has since been deleted. Render a neutral placeholder for that case. The API deliberately does not hand out a name you may not see, and the raw user id is not a label.
• image is the avatar delivery URL, or null when the person has no picture. It is an authorizing path on this API, not a public bucket URL, so it must be requested with the same credentials.

Common errorsCopy Anchor Link

• 401 Unauthorized when not authenticated
• 403 Forbidden (customerScopedTokenForbidden) when using a customer-scoped token
• 403 Forbidden (imAccessDenied) when the session user has no IM-eligible role
• 403 Forbidden (imNotEnabled) when Incident Management is not enabled for the organization
• 400 Bad Request (invalidRequestBody) when a filter value is invalid: an unknown status/severity/category, a teamId/customerId/sourceId/serviceId that is not a positive integer, an unparsable from/to/asOf/cursor, a limit or page below 1, or page and cursor sent together