Retrieve a list of incidents for the organization.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Authorization
This endpoint requires Authorization.
Pagination
Returns up to per_page incidents per call (default 100, max 500), sorted by created_at from oldest to newest, with ties broken by incident id. The order is stable, so walking the pages returns every matching incident exactly once. To fetch the complete list:
- Pick explicit
fromandtovalues (for example, one week ago and the current time) and send the same values on every call. Both default relative to the time of each request, so a window left to the defaults moves between calls and incidents at page boundaries get skipped. - Request
page=1, then keep requesting the page innext_pageuntil it isnull.
Besides items, every response carries:
| Key | Type | Description |
|---|---|---|
| next_page | number | null | The next page number, or null on the last page |
| has_next_page | boolean | true while more pages follow |
| total_count | number | How many incidents match the filters across all pages |
Response
Returns Paginated data of the following format for each item:
| Key | Type | Description |
|---|---|---|
| uuid | string | Unique identifier of the incident |
| status | string | "active" / "closed" |
| priority | string | "critical" / "high" / "moderate" / "low" / "planning" |
| issue | string | Short name of the issue that caused the incident |
| title | string | Incident title |
| description | string | Detailed description |
| device_id | string | Device UUID |
| device_name | string | Name of the device |
| device_model | string | Name of the device's model |
| device_sub_model | string | Name of the device's sub model (if available) |
| partner_name | string | Name of the device manufacturer |
| space_id | number | Unique identifier of the space the device is in |
| space_tree_path_name | string | Location of the device in the space tree |
| space_name | string | Name of the space the device is in |
| created_at | string | Date and time when the incident was created in ISO 8601 format (e.g., "2024-07-17T07:09:26Z"). |
| updated_at | string | Date and time when the incident was last updated in ISO 8601 format (e.g., "2024-07-17T07:09:26Z"). |
| issuer_name | string | Name of the User who created the command (if available) |
Notification state
Add with_notifications=true to the query to learn which of the organization's integrations (ServiceNow, Jira, Freshdesk, Slack, email, webhooks, ...) each incident was sent to. Two keys are then added to every item:
| Key | Type | Description |
|---|---|---|
| notified | boolean | Whether the opening notification reached at least one integration |
| notifications | array | One entry per integration the incident was dispatched to (see below); empty when there was none |
Each notifications entry:
| Key | Type | Description |
|---|---|---|
| integration_id | string | Unique identifier of the integration |
| integration_type | string | Integration driver, e.g. service_now, jira, freshdesk, slack, msteams, email, web_hook |
| status | string | Outcome of the opening notification: sent / failed / skipped. Later updates and closes do not change it; an update or close of an incident whose opening notification was never recorded records nothing |
| action | string | Last incident event dispatched to the integration: create / update / close |
| notified_at | string | Date and time the opening notification was delivered, ISO 8601 (null until it is) |
| external_id | string | Id of the record the opening notification created on the integration's side: ServiceNow sys_id, Jira issue id, Freshdesk ticket id, ConnectWise ticket id, FreshService request number, Salesforce case id, Slack ts |
| external_reference | string | Human-readable handle on the integration's side, e.g. the ServiceNow incident number or the Slack channel |
| external_url | string | Link to the external record when the integration provides one (ServiceNow, Freshdesk) |
| reason | string | Why the opening notification was not sent. failed: no_remote_reference (null for a delivery error). skipped: priority_filter, integration_inactive, handler_declined, reference_already_present (another integration of the same ticketing type - ServiceNow, Jira, Freshdesk, ConnectWise or FreshService - had already opened the incident's ticket on that system) |
To list only the incidents that were (or were not) notified, filter with notified=true / notified=false; the filter works with or without with_notifications.
Notification state is recorded from the day this feature was released. Older incidents show"notified": falsewith an emptynotificationslist even if a ticket was raised for them at the time.
