---
title: "List Incidents"
description: "Returns a filtered, cursor-paginated list of Incident Management incidents for your organization."
---

`GET /api/im/incidents`

Returns a filtered, cursor-paginated list of incidents for your organization. Only `im_incident` fields are returned. Alerts, timeline events, and assignments are available on the [Get Incident](./get-incident) endpoint.

## Authentication

Requires a session or API token with IM access (`admin`, `editor`, or `responder` role; an organization-wide API token also works). Incident Management must be enabled for the organization.

## Query Parameters

| Parameter | Type | Description |
|-----------|------|--------------|
| `status` | string, repeatable | Filter by status. One or more of `triggered`, `acknowledged`, `investigating`, `identified`, `monitoring`, `resolved`, `merged`. |
| `severity` | string, repeatable | Filter by severity. One or more of `sev1`, `sev2`, `sev3`, `sev4`. |
| `teamId` | number, repeatable | Filter by owning team ID. |
| `customerId` | number, repeatable | Filter by the incident's associated customer ID. |
| `sourceId` | number, repeatable | Filter by primary alert source ID. |
| `assignedUserId` | string | Only incidents with an active assignment (any role) for this user ID. |
| `onCall` | boolean (`true`/`false`/`1`/`0`) | `true` restricts to incidents owned by a team you are currently on-call for. If you are on-call for no team, returns an empty page. `false` or omitted applies no on-call filtering. |
| `from` | ISO 8601 date-time | Only incidents triggered at or after this time. |
| `to` | ISO 8601 date-time | Only incidents triggered at or before this time. |
| `q` | string | Full-text search on the incident title. Whole-word matching only, no prefix search. |
| `limit` | number | Page size. Default 50, max 100. |
| `cursor` | string | Continuation token from a previous response's `nextCursor`. Treat as opaque: round-trip it exactly, do not construct one yourself. |

A repeatable parameter accepts a repeated query key, e.g. `status=triggered&status=acknowledged`.

## Example (cURL)

```bash
curl -X GET "$BASE_URL/api/im/incidents?status=triggered&status=acknowledged&severity=sev1&limit=25" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json"
```

## Response

```json
{
  "items": [
    {
      "id": 42,
      "organizationId": 1,
      "teamId": 3,
      "title": "Database connection pool exhausted",
      "customerId": null,
      "primarySourceId": 7,
      "severity": "sev1",
      "severityManual": false,
      "status": "triggered",
      "mergedIntoId": null,
      "escalationPolicyId": 5,
      "currentTier": 1,
      "escalationEpoch": 0,
      "acknowledgedBy": null,
      "acknowledgedAt": null,
      "snoozedUntil": null,
      "autoResolve": true,
      "resolvedBy": null,
      "resolveNote": null,
      "createdBy": null,
      "sourceKind": "alert",
      "triggeredAt": "2026-07-17T09:12:00.000Z",
      "resolvedAt": null
    }
  ],
  "nextCursor": "1752743520000:42"
}
```

`nextCursor` is `null` on the last page. Pass it back as the `cursor` query parameter to fetch the next page.

## Common errors

- `401 Unauthorized` when not authenticated
- `403 Forbidden` (`imAccessDenied`) when using a customer-scoped token, or a session without an IM-eligible role
- `403 Forbidden` (`imNotEnabled`) when Incident Management is not enabled for the organization
- `400 Bad Request` (`invalidRequestBody`) when a filter value is invalid, e.g. an unknown `status`/`severity`, a non-numeric `teamId`/`customerId`/`sourceId`, an unparsable `from`/`to`/`cursor`, or an out-of-range `limit`