---
title: "Retrieve data and tickets"
method: GET
path: "/v1/tickets/summary/data"
tags: ["tickets-summary"]
---

# Retrieve data and tickets

`GET /v1/tickets/summary/data`

Retrieve a summary of monitored data and associated tickets for a workspace. The summary includes the total number of open tickets, closed tickets, monitored data with associated tickets, and monitored data with no associated tickets.

## Query parameters

- `resolvedFromTime` integer

## Headers

- `Workspace` string, required

## Response `200`

Success

- DataSummaryResponse
  - `openTickets` TicketCountResponse[] — The number of open tickets, grouped by the ticket trigger. — unresolved $ref
  - `closedTickets` TicketCountResponse[] — The number of closed tickets, grouped by the ticket trigger; includes all data triggers. — unresolved $ref
  - `topViolators` ViolatorResponse[] — A list of the top five protected users who violated data policies.
    - `email` string — The email of the protected user who violated data policies.
    - `count` integer — The number of tickets generated by the protected user who violated data policies.
    - `percentage` number, float — The percentage of tickets generated by the protected user who violated data policies out of the top five violators.
  - `objectsScanned` integer — The total number of records that were scanned, such as files and emails.

## Other responses

- `400` — Bad request, validation error
- `401` — Unauthorized request
- `403` — Access forbidden
- `429` — Too Many Requests
- `500` — Internal server error

---

[API](https://skmtc.dev/coro/apis/coro-cybersecurity-public-api.md) · [All operations](https://skmtc.dev/coro/apis/coro-cybersecurity-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/coro/coro-cybersecurity-public-api/revisions/b635522b2393/schema)