---
title: "List incidents"
method: GET
path: "/v2/incidents"
tags: ["incidents"]
---

# List incidents

`GET /v2/incidents`

## Request

- Base URL: `https://api.cloudzero.com`
- URL: `https://api.cloudzero.com/v2/incidents`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/cloudzero/apis/cloudzero-api-v2-resources/docs/v2/incidents/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns a page of incidents across all monitors. Follow `next_cursor` until it is null. Once a cursor is passed, `limit`, `sort_key` and `sort_order` are ignored in favour of the cursor's paging and sort, though `limit` must still be within 1-100 if sent.

## Query parameters

- `limit` integer, nullable: Page size, 1-100
- `sort_key` string, nullable: cost_impact or start_date
- `sort_order` string, nullable: asc or desc
- `monitor_id` string[], nullable: Only incidents from these monitors
- `status` string[], nullable: active, investigating and/or resolved
- `spend_status` string[], nullable: ongoing and/or returned_to_baseline
- `cursor` string, nullable: Opaque `next_cursor` from the previous page

## Response `200`

Successful Response

- IncidentList
  - `items` IncidentSummary[], required
    - `cost_impact` number, required: Total cost impact: spend above the expected range, summed over the anomalous days
    - `incident_id` string, required: Unique identifier for the incident
    - `monitor_id` string, required: The monitor that raised the incident
    - `monitor_name` string, required: Name of the monitor that raised the incident
    - `pct_above_baseline` number, nullable, required: Total actual spend over total expected spend across the anomalous days, as a percent; null when it cannot be computed
    - `spend_status` string, required: `ongoing` while spend is anomalous, or `returned_to_baseline` after two days without anomalous spend
    - `start_date` string, date, required: First anomalous day, as an ISO 8601 date
    - `status` string, required: Workflow status: `active`, `investigating` or `resolved`
    - `summary` string, nullable, required: Short description of the incident: one line of plain text, usually under 100 characters and never more than 250, with no Markdown or line breaks; suited to tables, chat messages and ticket titles. Null when the analysis has not produced one
    - `title` string, nullable, required: Short headline for the incident, such as "EC2 spend up 64% in account 123456789012"
    - `work_item` IncidentWorkItem: Display snapshot of the ticket linked to an incident, taken when the link was created.
      - `display_id` string, nullable
      - `display_name` string, nullable
      - `provider` string, nullable
      - `ticket_url` string, nullable
  - `next_cursor` string, nullable, required

## Other responses

- `400`: Malformed request, such as an undecodable cursor or an unknown filter value
- `401`: Unauthorized: the API key is missing or invalid (gateway `{"message": ...}` body), or the key carries no organization
- `403`: Forbidden: the API key lacks the scope for this operation (gateway `{"message": ...}` body)
- `422`: A parameter failed validation; `details` lists each field failure when present

## Changes

- **2026-11-03** `56a692cf51b1`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/cloudzero/apis/cloudzero-api-v2-resources/changes/v2/incidents/get.md)

---

[API](https://skmtc.dev/cloudzero/apis/cloudzero-api-v2-resources.md) - [All operations](https://skmtc.dev/cloudzero/apis/cloudzero-api-v2-resources/llms.txt) - [OpenAPI document](https://skmtc.dev/cloudzero/apis/cloudzero-api-v2-resources/revisions/56a692cf51b1?raw)