List Incidents

Returns a filtered, cursor-paginated list of Incident Management incidents for your organization.

GET /api/im/incidents

Returns a filtered, cursor-paginated list of incidents for your organization. Only im_incident fields are returned. Alerts, timeline events, and assignments are available on the Get Incident endpoint.

Authentication

Requires a session or API token with IM access (admin, editor, or responder role; an organization-wide API token also works). Incident Management must be enabled for the organization.

Query Parameters

Parameter	Type	Description
`status`	string, repeatable	Filter by status. One or more of `triggered`, `acknowledged`, `investigating`, `identified`, `monitoring`, `resolved`, `merged`.
`severity`	string, repeatable	Filter by severity. One or more of `sev1`, `sev2`, `sev3`, `sev4`.
`teamId`	number, repeatable	Filter by owning team ID.
`customerId`	number, repeatable	Filter by the incident's associated customer ID.
`sourceId`	number, repeatable	Filter by primary alert source ID.
`assignedUserId`	string	Only incidents with an active assignment (any role) for this user ID.
`onCall`	boolean (`true`/`false`/`1`/`0`)	`true` restricts to incidents owned by a team you are currently on-call for. If you are on-call for no team, returns an empty page. `false` or omitted applies no on-call filtering.
`from`	ISO 8601 date-time	Only incidents triggered at or after this time.
`to`	ISO 8601 date-time	Only incidents triggered at or before this time.
`q`	string	Full-text search on the incident title. Whole-word matching only, no prefix search.
`limit`	number	Page size. Default 50, max 100.
`cursor`	string	Continuation token from a previous response's `nextCursor`. Treat as opaque: round-trip it exactly, do not construct one yourself.

A repeatable parameter accepts a repeated query key, e.g. status=triggered&status=acknowledged.

Example (cURL)

curl -X GET "$BASE_URL/api/im/incidents?status=triggered&status=acknowledged&severity=sev1&limit=25" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json"

Response

{
  "items": [
    {
      "id": 42,
      "organizationId": 1,
      "teamId": 3,
      "title": "Database connection pool exhausted",
      "customerId": null,
      "primarySourceId": 7,
      "severity": "sev1",
      "severityManual": false,
      "status": "triggered",
      "mergedIntoId": null,
      "escalationPolicyId": 5,
      "currentTier": 1,
      "escalationEpoch": 0,
      "acknowledgedBy": null,
      "acknowledgedAt": null,
      "snoozedUntil": null,
      "autoResolve": true,
      "resolvedBy": null,
      "resolveNote": null,
      "createdBy": null,
      "sourceKind": "alert",
      "triggeredAt": "2026-07-17T09:12:00.000Z",
      "resolvedAt": null
    }
  ],
  "nextCursor": "1752743520000:42"
}

nextCursor is null on the last page. Pass it back as the cursor query parameter to fetch the next page.

Common errors

401 Unauthorized when not authenticated
403 Forbidden (imAccessDenied) when using a customer-scoped token, or a session without an IM-eligible role
403 Forbidden (imNotEnabled) when Incident Management is not enabled for the organization
400 Bad Request (invalidRequestBody) when a filter value is invalid, e.g. an unknown status/severity, a non-numeric teamId/customerId/sourceId, an unparsable from/to/cursor, or an out-of-range limit