---
title: "GET /app/api/v1/investigation"
method: GET
path: "/app/api/v1/investigation"
tags: ["investigation"]
---

# GET /app/api/v1/investigation

`GET /app/api/v1/investigation`

List investigations (with optional filtering, sorting, and search)

Returns a paginated list of investigations. By default, only completed investigations
(state='success') are returned. Use query parameters to filter by state, outcomes,
priorities, date ranges, and more.

## Query parameters

- `alert_create_from` string
- `alert_create_until` string
- `alert_start_from` string
- `alert_start_until` string
- `alert_tenants` string[]
- `alert_types` string[]
- `attack_surfaces` string[]
- `direct_source_labels` string[]
- `feedback_updated_from` string
- `feedback_updated_until` string
- `insight_tag_names` string[]
- `interview_statuses` string[]
- `inv_complete_from` string
- `inv_complete_until` string
- `investigation_state` 'error' | 'loading' | 'not_asked' | 'success'
- `limit` integer
- `mitre_tactics` string[]
- `offset` integer
- `outcomes` string[]
- `priorities` string[]
- `priority_statuses` string[]
- `search` string
- `sort_dir` 'asc' | 'desc'
- `sort_type` 'activity' | 'alert_create' | 'alert_source' | 'alert_title' | 'alert_type' | 'feedback_status' | 'investigation_create' | 'outcome' | 'priority_status' | 'stopped_reason'
- `stopped_reasons` string[]
- `tenant_id` string
- `tenant_integration_key` string
- `user_statuses` string[]

## Response `200`

<strong>Paginated list of investigations</strong>
<br><br>
Returns a paginated list of investigations. By default, only completed investigations
(state='success') are returned. Use query parameters to filter by state, outcomes,
priorities, date ranges, and more.
<br><br>
Use <code>next</code> and <code>previous</code>
URLs in the response for easy page navigation.
<br><br>

- PaginatedInvestigationList
  - `count` integer, required — Total number of investigations
  - `next` string, uri, nullable, required — URL to next page of results
  - `previous` string, uri, nullable, required — URL to previous page of results
  - `results` ScriptVarSerializerInvestigation[], required
    - `alert` ScriptVarSerializerAlert, required
      - `alert_type` string, required
      - `assets` object
      - `coalesce_key` string, nullable
      - `create_time` string, date-time, required
      - `created_at` string, date-time, required
      - `direct_source_label` string, required
      - `entities` object
      - `id` integer, required
      - `origin_integration` string, nullable
      - `origin_ticket_id` string, nullable
      - `origin_ticket_id_label` string, nullable
      - `origin_ticket_url` string, nullable
      - `original_title` string
      - `proxy_source_label` string, nullable
      - `raw_alert_content` string, required
      - `schema_key` string, required
      - `severity` string, nullable
      - `start_time` string, date-time, nullable
      - `tenant_id` string, nullable
      - `tenant_integration_key` string, nullable
      - `tenant_label` string, nullable
      - `tenant_union` ScriptVarSerializerTenantUnion, required
        - `created_at` string, date-time, required
        - `display_name` string, required
        - `id` integer, required
        - `lookup_dict` object
        - `updated_at` string, date-time, required
      - `title` string, required
      - `updated_at` string, date-time, required
    - `alert_summary` string, nullable
    - `attack_surface` string, nullable
    - `canceled` union
      - 'CANCEL_MANUAL' | 'CANCEL_THRESHOLD' — * `CANCEL_MANUAL` - CANCEL_MANUAL * `CANCEL_THRESHOLD` - CANCEL_THRESHOLD
      - unknown
    - `conclusion` string, required
    - `conclusion_summary` string, nullable
    - `created_at` string, date-time, required
    - `custom_outcome` object, nullable, required
    - `error_msg` string, nullable
    - `exec_summary` string, nullable
    - `feedback` ScriptVarSerializerInvestigationFeedback, required
      - `conclusion` string, required
      - `conclusion_summary` string, nullable
      - `created_at` string, date-time, required
      - `findings` object
      - `findings_ranking` object, nullable
      - `id` integer, required
      - `insight_tags` object, nullable
      - `key_findings` object, nullable
      - `outcome` union
        - 'COMPLETED_BREACHED_CONFIRMED' | 'COMPLETED_BREACHED_SUSPICIOUS' | 'COMPLETED_FALSE_ALERT' | 'INCOMPLETE' | 'IGNORED' — * `COMPLETED_BREACHED_CONFIRMED` - COMPLETED_BREACHED_CONFIRMED * `COMPLETED_BREACHED_SUSPICIOUS` - COMPLETED_BREACHED_SUSPICIOUS * `COMPLETED_FALSE_ALERT` - COMPLETED_FALSE_ALERT * `INCOMPLETE` - INCOMPLETE * `IGNORED` - IGNORED
        - unknown
      - `outcome_note` string, nullable
      - `priority` union
        - 'informational' | 'notable' | 'urgent' — * `informational` - Informational * `notable` - Notable * `urgent` - Urgent
        - unknown
      - `remediations_done` object
      - `status` 'in_review' | 'reviewed' — * `in_review` - In Review * `reviewed` - Reviewed
      - `updated_at` string, date-time, required
    - `findings` object
    - `findings_ranking` object
    - `generated_time` string, date-time, nullable
    - `id` integer, required
    - `ignored_for_investigation_id` integer, nullable, required
    - `insight_tags` object
    - `interview_proposals` object
    - `inv_url` string, required
    - `key_findings` object
    - `mitre_tactic` string, nullable
    - `outcome` union
      - 'COMPLETED_BREACHED_CONFIRMED' | 'COMPLETED_BREACHED_SUSPICIOUS' | 'COMPLETED_FALSE_ALERT' | 'INCOMPLETE' | 'IGNORED' — * `COMPLETED_BREACHED_CONFIRMED` - COMPLETED_BREACHED_CONFIRMED * `COMPLETED_BREACHED_SUSPICIOUS` - COMPLETED_BREACHED_SUSPICIOUS * `COMPLETED_FALSE_ALERT` - COMPLETED_FALSE_ALERT * `INCOMPLETE` - INCOMPLETE * `IGNORED` - IGNORED
      - unknown
    - `priority` union
      - 'informational' | 'notable' | 'urgent' — * `informational` - Informational * `notable` - Notable * `urgent` - Urgent
      - unknown
    - `recommended_remediations` object
    - `remediation_action_runs` ScriptVarSerializerRemediationActionRun[], required
      - `entity` string
      - `remediation_action` ScriptVarSerializerRemediationAction, required
        - `name` string, required
    - `start_time` string, date-time, nullable
    - `status` 'not_asked' | 'loading' | 'success' | 'error' — * `not_asked` - not_asked * `loading` - loading * `success` - success * `error` - error
    - `updated_at` string, date-time, required

## Other responses

- `400` — Bad request - invalid input
- `401` — Unauthorized
- `403` — Access denied
- `500` — System error
- `503` — System not ready for requests

---

[API](https://skmtc.dev/dropzone/apis/dropzone-ai.md) · [All operations](https://skmtc.dev/dropzone/apis/dropzone-ai/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/dropzone/dropzone-ai/revisions/f7323013d0aa/schema)