---
title: "List detection hits"
method: GET
path: "/api/detections/hits"
tags: ["Detections"]
---

# List detection hits

`GET /api/detections/hits`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/detections/hits`
- Auth: HTTP bearer

Retrieve a flattened hit feed across all detections in the current organization. Pass `detectionId` to restrict the feed (and its aggregate summary) to a single detection — used by the detection-agent detail page to surface verifier evidence + cited tool calls without leaving the page. Uses a single batch query instead of N concurrent queries per detection.

## Query parameters

- `limit` integer: Maximum number of hits to return per page (1-200, default: 100)
- `offset` integer: Number of hits to skip for pagination (default: 0)
- `detectionId` string, uuid: Restrict the feed to hits produced by a single detection agent. When omitted, returns hits across all accessible detections.
- `severityFilter` string: Comma-separated severities to include, such as "high,critical". When omitted, returns all severities.
- `excludeAlerted` 'true' | 'false': Opt-in. "true" leaves out hits that already created an alert (alerts.origin_detection_hit_id). Default: false, all open hits.
- `includeSummary` 'true' | 'false': Opt-in. "false" skips the aggregate summary queries, so the response has no summary. Default: true (summary is returned when offset is 0).

## Response `200`

Successful response

- object
  - `hits` object[], required
    - `id` string, required
    - `detectionId` string, uuid, required
    - `detectionName` string, required
    - `detectionDescription` string, nullable, required
    - `detectionCategory` string, nullable, required
    - `detectionIsBuiltIn` boolean, required
    - `detectionSiemType` string, nullable, required
    - `runId` string, uuid, required
    - `runTitle` string, required
    - `runCreatedAt` string, required
    - `hitCreatedAt` string, required: When this hit was recorded
    - `isAutonomousHuntHit` boolean, required: Whether this hit was recorded by the autonomous hunt orchestrator
    - `status` 'open' | 'dismissed_fp' | 'dismissed_tpb' | 'resolved_tp' | 'dismissed_old'
    - `statusHistory` object[]
      - `status` 'open' | 'dismissed_fp' | 'dismissed_tpb' | 'resolved_tp' | 'dismissed_old', required: Status after this transition
      - `at` string, date-time, required: ISO timestamp when the status transition occurred
      - `by` string, uuid, nullable, required: User who made the transition, or null for system-created entries
      - `reason` string: Optional reason or note for the transition
    - `entityType` string, nullable, required
    - `confidence` number, nullable, required
    - `evidence` string[], required
    - `summary` string, nullable, required
    - `headline` string, nullable, required
    - `cta` string, nullable, required
    - `statistics` string[], required
    - `severity` 'low' | 'medium' | 'high' | 'critical', required
    - `entity` string, required
    - `verifierEvidence` string[]: Curated evidence bullets authored by the hit-evidence sub-agent. Each bullet may contain inline <cite id="<toolUseId>">...</cite> spans pointing at the tool calls that established it. Omitted (or empty) when the sub-agent did not produce one.
  - `totalCount` number, required: Total number of hits across all detections (for pagination)
  - `summary` object: Aggregate summary for all matching hits (returned on initial page load)
    - `uniqueDetections` integer, required: Number of distinct detections represented by all matching hits
    - `avgConfidence` number, required: Average confidence across all matching hits with a numeric confidence value
    - `hitsLast24h` integer, required: Number of matching hits created in the last 24 hours
    - `hitsOverTime` object[], required: Daily hit counts for the trailing 30 days (UTC)
      - `date` string, required: UTC date key in YYYY-MM-DD format
      - `count` integer, required
    - `severityCounts` object, required: Severity distribution across all matching hits
      - `critical` integer, required
      - `high` integer, required
      - `medium` integer, required
      - `low` integer, required

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)