List Incidents

GET /api/im/incidents

Returns a filtered, cursor-paginated list of incidents for your organization. Each item carries the incident's own fields plus a small, page-level enrichment: the primary assignee, the people on the lifecycle columns, and the incident's alert activity (see Resolved people below). An incident's full alerts, timeline events, and assignments are available on the Get Incident endpoint.

Authentication

Requires a session or API token with IM access (admin, editor, or responder role; an organization-wide API token also works). Incident Management must be enabled for the organization.

Query Parameters

A repeatable parameter accepts a repeated query key, e.g. status=triggered&status=acknowledged.

Example (cURL)

curl -X GET "$BASE_URL/api/im/incidents?status=triggered&status=acknowledged&severity=sev1&limit=25" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json"

Response

{
  "items": [
    {
      "id": 42,
      "organizationId": 1,
      "teamId": 3,
      "title": "Database connection pool exhausted",
      "customerId": null,
      "primarySourceId": 7,
      "severity": "sev1",
      "severityManual": false,
      "status": "triggered",
      "mergedIntoId": null,
      "escalationPolicyId": 5,
      "currentTier": 1,
      "escalationEpoch": 0,
      "acknowledgedBy": "MFcTjWmYq2LpzR8vK1sXo",
      "acknowledgedAt": "2026-07-17T09:15:31.000Z",
      "snoozedUntil": null,
      "autoResolve": true,
      "resolvedBy": null,
      "resolveNote": null,
      "createdBy": null,
      "sourceKind": "alert",
      "triggeredAt": "2026-07-17T09:12:00.000Z",
      "resolvedAt": null,
      "assignee": {
        "userId": "MFcTjWmYq2LpzR8vK1sXo",
        "name": "Grace Hopper",
        "role": "commander",
        "image": "/api/assets/avatar/MFcTjWmYq2LpzR8vK1sXo"
      },
      "createdByUser": null,
      "acknowledgedByUser": {
        "userId": "MFcTjWmYq2LpzR8vK1sXo",
        "name": "Grace Hopper",
        "image": "/api/assets/avatar/MFcTjWmYq2LpzR8vK1sXo"
      },
      "resolvedByUser": null,
      "lastAlertAt": "2026-07-17T09:41:00.000Z",
      "alertDuplicateCount": 3
    }
  ],
  "nextCursor": "1752743520000:42"
}

nextCursor is null on the last page. Pass it back as the cursor query parameter to fetch the next page.

lastAlertAt is the newest alert-shaped timeline event for the incident (null when it has none), and alertDuplicateCount is the number of repeat firings its alerts absorbed through deduplication. Neither touches an im_incident column, which is why they are reported separately.

Resolved people

assignee is the incident's primary role holder (commander beats tech_lead beats comms beats assignee), or null when nobody holds a role on it.

createdByUser, acknowledgedByUser and resolvedByUser are the people behind the createdBy, acknowledgedBy and resolvedBy user ids on the same row. Each is null when the corresponding id is null.

Every one of these is resolved server-side in one batched, organization-scoped lookup for the whole page:

• name is the person's display name, falling back to their e-mail address when their profile carries none.
• name is null when the id belongs to a user outside your organization, for example a platform administrator acting across tenants, or an account that has since been deleted. Render a neutral placeholder for that case. The API deliberately does not hand out a name you may not see, and the raw user id is not a label.
• image is the avatar delivery URL, or null when the person has no picture. It is an authorizing path on this API, not a public bucket URL, so it must be requested with the same credentials.

Common errors

• 401 Unauthorized when not authenticated
• 403 Forbidden (imAccessDenied) when using a customer-scoped token, or a session without an IM-eligible role
• 403 Forbidden (imNotEnabled) when Incident Management is not enabled for the organization
• 400 Bad Request (invalidRequestBody) when a filter value is invalid, e.g. an unknown status/severity, a non-numeric teamId/customerId/sourceId, an unparsable from/to/cursor, or an out-of-range limit