--- title: "Search for incidents" method: GET path: "/api/v2/incidents/search" tags: ["Incidents"] --- # Search for incidents `GET /api/v2/incidents/search` ## Request - Base URL: `https://api.datadoghq.com` - URL: `https://api.datadoghq.com/api/v2/incidents/search` - Auth: one of: - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY` - OAuth 2 - Authorization code: `/oauth2/v1/authorize` - Token URL: `/oauth2/v1/token` scopes: `incident_read` Search for incidents matching a certain query. ## Query parameters - `include` 'users' | 'attachments': Object related to an incident. - `query` string, required - `sort` 'created' | '-created': The ways searched incidents can be sorted. - `page[size]` integer - `page[offset]` integer ## Response `200` OK - IncidentSearchResponse: Response with incidents and facets. - `data` IncidentSearchResponseData, required: Data returned by an incident search. - `attributes` IncidentSearchResponseAttributes: Attributes returned by an incident search. - `facets` IncidentSearchResponseFacetsData, required: Facet data for incidents returned by a search query. - `commander` IncidentSearchResponseUserFacetData[]: Facet data for incident commander users. - `count` integer: Count of the facet value appearing in search results. - `email` string: Email of the user. - `handle` string: Handle of the user. - `name` string: Name of the user. - `uuid` string: ID of the user. - `created_by` IncidentSearchResponseUserFacetData[]: Facet data for incident creator users. - `count` integer: Count of the facet value appearing in search results. - `email` string: Email of the user. - `handle` string: Handle of the user. - `name` string: Name of the user. - `uuid` string: ID of the user. - `fields` IncidentSearchResponsePropertyFieldFacetData[]: Facet data for incident property fields. - `aggregates` IncidentSearchResponseNumericFacetDataAggregates: Aggregate information for numeric incident data. - `max` number, double, nullable: Maximum value of the numeric aggregates. - `min` number, double, nullable: Minimum value of the numeric aggregates. - `facets` IncidentSearchResponseFieldFacetData[], required: Facet data for the property field of an incident. - `count` integer: Count of the facet value appearing in search results. - `name` string: The facet value appearing in search results. - `name` string, required: Name of the incident property field. - `impact` IncidentSearchResponseFieldFacetData[]: Facet data for incident impact attributes. - `count` integer: Count of the facet value appearing in search results. - `name` string: The facet value appearing in search results. - `last_modified_by` IncidentSearchResponseUserFacetData[]: Facet data for incident last modified by users. - `count` integer: Count of the facet value appearing in search results. - `email` string: Email of the user. - `handle` string: Handle of the user. - `name` string: Name of the user. - `uuid` string: ID of the user. - `postmortem` IncidentSearchResponseFieldFacetData[]: Facet data for incident postmortem existence. - `count` integer: Count of the facet value appearing in search results. - `name` string: The facet value appearing in search results. - `responder` IncidentSearchResponseUserFacetData[]: Facet data for incident responder users. - `count` integer: Count of the facet value appearing in search results. - `email` string: Email of the user. - `handle` string: Handle of the user. - `name` string: Name of the user. - `uuid` string: ID of the user. - `severity` IncidentSearchResponseFieldFacetData[]: Facet data for incident severity attributes. - `count` integer: Count of the facet value appearing in search results. - `name` string: The facet value appearing in search results. - `state` IncidentSearchResponseFieldFacetData[]: Facet data for incident state attributes. - `count` integer: Count of the facet value appearing in search results. - `name` string: The facet value appearing in search results. - `time_to_repair` IncidentSearchResponseNumericFacetData[]: Facet data for incident time to repair metrics. - `aggregates` IncidentSearchResponseNumericFacetDataAggregates, required: Aggregate information for numeric incident data. - `max` number, double, nullable: Maximum value of the numeric aggregates. - `min` number, double, nullable: Minimum value of the numeric aggregates. - `name` string, required: Name of the incident property field. - `time_to_resolve` IncidentSearchResponseNumericFacetData[]: Facet data for incident time to resolve metrics. - `aggregates` IncidentSearchResponseNumericFacetDataAggregates, required: Aggregate information for numeric incident data. - `max` number, double, nullable: Maximum value of the numeric aggregates. - `min` number, double, nullable: Minimum value of the numeric aggregates. - `name` string, required: Name of the incident property field. - `incidents` IncidentSearchResponseIncidentsData[], required: Incidents returned by the search. - `data` IncidentResponseData, required: Incident data from a response. - `attributes` IncidentResponseAttributes: The incident's attributes from a response. - `archived` string, date-time, nullable: Timestamp of when the incident was archived. - `case_id` integer, nullable: The incident case id. - `created` string, date-time: Timestamp when the incident was created. - `customer_impact_duration` integer: Length of the incident's customer impact in seconds. Equals the difference between `customer_impact_start` and `customer_impact_end`. - `customer_impact_end` string, date-time, nullable: Timestamp when customers were no longer impacted by the incident. - `customer_impact_scope` string, nullable: A summary of the impact customers experienced during the incident. - `customer_impact_start` string, date-time, nullable: Timestamp when customers began being impacted by the incident. - `customer_impacted` boolean: A flag indicating whether the incident caused customer impact. - `declared` string, date-time: Timestamp when the incident was declared. - `declared_by` IncidentNonDatadogCreator, nullable: Incident's non Datadog creator. - … - `declared_by_uuid` string, nullable: UUID of the user who declared the incident. - `detected` string, date-time, nullable: Timestamp when the incident was detected. - `fields` object: A condensed view of the user-defined fields attached to incidents. - `incident_type_uuid` string: A unique identifier that represents an incident type. - `is_test` boolean: A flag indicating whether the incident is a test incident. - `modified` string, date-time: Timestamp when the incident was last modified. - `non_datadog_creator` IncidentNonDatadogCreator, nullable: Incident's non Datadog creator. - … - `notification_handles` IncidentNotificationHandle[], nullable: Notification handles that will be notified of the incident during update. - … - `public_id` integer: The monotonically increasing integer ID for the incident. - `resolved` string, date-time, nullable: Timestamp when the incident's state was last changed from active or stable to resolved or completed. - `severity` 'UNKNOWN' | 'SEV-0' | 'SEV-1' | 'SEV-2' | 'SEV-3' | 'SEV-4' | 'SEV-5': The incident severity. - `state` string, nullable: The state incident. - `time_to_detect` integer: The amount of time in seconds to detect the incident. Equals the difference between `customer_impact_start` and `detected`. - `time_to_internal_response` integer: The amount of time in seconds to call incident after detection. Equals the difference of `detected` and `created`. - `time_to_repair` integer: The amount of time in seconds to resolve customer impact after detecting the issue. Equals the difference between `customer_impact_end` and `detected`. - `time_to_resolve` integer: The amount of time in seconds to resolve the incident after it was created. Equals the difference between `created` and `resolved`. - `title` string, required: The title of the incident, which summarizes what happened. - `visibility` string, nullable: The incident visibility status. - `id` string, required: The incident's ID. - `relationships` IncidentResponseRelationships: The incident's relationships from a response. - `attachments` RelationshipToIncidentAttachment: A relationship reference for attachments. - … - `commander_user` NullableRelationshipToUser, nullable: Relationship to user. - … - `created_by_user` RelationshipToUser: Relationship to user. - … - `declared_by_user` RelationshipToUser: Relationship to user. - … - `impacts` RelationshipToIncidentImpacts: Relationship to impacts. - … - `integrations` RelationshipToIncidentIntegrationMetadatas: A relationship reference for multiple integration metadata objects. - … - `last_modified_by_user` RelationshipToUser: Relationship to user. - … - `responders` RelationshipToIncidentResponders: Relationship to incident responders. - … - `user_defined_fields` RelationshipToIncidentUserDefinedFields: Relationship to incident user defined fields. - … - `type` 'incidents', required: Incident resource type. - `total` integer, required: Number of incidents returned by the search. - `type` 'incidents_search_results': Incident search result type. - `included` IncidentResponseIncludedItem[]: Included related resources that the user requested. - union: An object related to an incident that is included in the response. - IncidentUserData: User object returned by the API. - `attributes` IncidentUserAttributes: Attributes of user object returned by the API. - `email` string: Email of the user. - `handle` string: Handle of the user. - `icon` string: URL of the user's icon. - `name` string, nullable: Name of the user. - `uuid` string: UUID of the user. - `id` string: ID of the user. - `type` 'users': Users resource type. - AttachmentData: Attachment data from a response. - `attributes` AttachmentDataAttributes, required: The attachment's attributes. - `attachment` AttachmentDataAttributesAttachment: The attachment object. - `documentUrl` string: The URL of the attachment. - `title` string: The title of the attachment. - `attachment_type` 'postmortem' | 'link': The type of the attachment. - `modified` string, date-time: Timestamp when the attachment was last modified. - `id` string, required: The unique identifier of the attachment. - `relationships` AttachmentDataRelationships, required: The attachment's resource relationships. - `incident` RelationshipToIncident: Relationship to incident. - `data` RelationshipToIncidentData, required: Relationship to incident object. - … - `last_modified_by_user` RelationshipToUser: Relationship to user. - `data` RelationshipToUserData, required: Relationship to user object. - … - `type` 'incident_attachments', required: The incident attachment resource type. - `meta` IncidentSearchResponseMeta: The metadata object containing pagination metadata. - `pagination` IncidentResponseMetaPagination: Pagination properties. - `next_offset` integer: The index of the first element in the next page of results. Equal to page size added to the current offset. - `offset` integer: The index of the first element in the results. - `size` integer: Maximum size of pages to return. ## Other responses - `400`: Bad Request - `401`: Unauthorized - `403`: Forbidden - `404`: Not Found - `429`: Too many requests --- [API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)