Get Incidents

Retrieve a list of incidents for the organization.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…

Authorization

This endpoint requires Authorization.

Pagination

Returns up to per_page incidents per call (default 100, max 500), sorted by created_at from oldest to newest, with ties broken by incident id. The order is stable, so walking the pages returns every matching incident exactly once. To fetch the complete list:

  1. Pick explicit from and to values (for example, one week ago and the current time) and send the same values on every call. Both default relative to the time of each request, so a window left to the defaults moves between calls and incidents at page boundaries get skipped.
  2. Request page=1, then keep requesting the page in next_page until it is null.

Besides items, every response carries:

KeyTypeDescription
next_pagenumber | nullThe next page number, or null on the last page
has_next_pagebooleantrue while more pages follow
total_countnumberHow many incidents match the filters across all pages

Response

Returns Paginated data of the following format for each item:

KeyTypeDescription
uuidstringUnique identifier of the incident
statusstring"active" / "closed"
prioritystring"critical" / "high" / "moderate" / "low" / "planning"
issuestringShort name of the issue that caused the incident
titlestringIncident title
descriptionstringDetailed description
device_idstringDevice UUID
device_namestringName of the device
device_modelstringName of the device's model
device_sub_modelstringName of the device's sub model (if available)
partner_namestringName of the device manufacturer
space_idnumberUnique identifier of the space the device is in
space_tree_path_namestringLocation of the device in the space tree
space_namestringName of the space the device is in
created_atstringDate and time when the incident was created in ISO 8601 format (e.g., "2024-07-17T07:09:26Z").
updated_atstringDate and time when the incident was last updated in ISO 8601 format (e.g., "2024-07-17T07:09:26Z").
issuer_namestringName of the User who created the command (if available)

Notification state

Add with_notifications=true to the query to learn which of the organization's integrations (ServiceNow, Jira, Freshdesk, Slack, email, webhooks, ...) each incident was sent to. Two keys are then added to every item:

KeyTypeDescription
notifiedbooleanWhether the opening notification reached at least one integration
notificationsarrayOne entry per integration the incident was dispatched to (see below); empty when there was none

Each notifications entry:

KeyTypeDescription
integration_idstringUnique identifier of the integration
integration_typestringIntegration driver, e.g. service_now, jira, freshdesk, slack, msteams, email, web_hook
statusstringOutcome of the opening notification: sent / failed / skipped. Later updates and closes do not change it; an update or close of an incident whose opening notification was never recorded records nothing
actionstringLast incident event dispatched to the integration: create / update / close
notified_atstringDate and time the opening notification was delivered, ISO 8601 (null until it is)
external_idstringId of the record the opening notification created on the integration's side: ServiceNow sys_id, Jira issue id, Freshdesk ticket id, ConnectWise ticket id, FreshService request number, Salesforce case id, Slack ts
external_referencestringHuman-readable handle on the integration's side, e.g. the ServiceNow incident number or the Slack channel
external_urlstringLink to the external record when the integration provides one (ServiceNow, Freshdesk)
reasonstringWhy the opening notification was not sent. failed: no_remote_reference (null for a delivery error). skipped: priority_filter, integration_inactive, handler_declined, reference_already_present (another integration of the same ticketing type - ServiceNow, Jira, Freshdesk, ConnectWise or FreshService - had already opened the incident's ticket on that system)

To list only the incidents that were (or were not) notified, filter with notified=true / notified=false; the filter works with or without with_notifications.

📘

Notification state is recorded from the day this feature was released. Older incidents show "notified": false with an empty notifications list even if a ticket was raised for them at the time.

Query Params
int32
Defaults to null
int32
Defaults to null
string

"active" or "closed"

string

"critical", "high", "moderate", "low" or "planning"

string

Partial string of title

string

Partial string of description

string

Partial string of issue

string

Partial string of device's model name

string

Partial string of device's manufacturer name

string

Partial string of device's sub model

string

Only incidents on devices in this space

int32
Defaults to 1

Page number, starting from 1. Follow next_page in the response until it is null.

int32
Defaults to 100

Incidents per page (max 500)

boolean

Only incidents whose opening notification did (true) or did not (false) reach at least one of the organization's integrations

boolean
Defaults to false

Add the notified flag and the notifications list to every incident (default false)

Responses

Language
Credentials
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json