---
title: "GET /api/v1/admin/ai/incidents"
method: GET
path: "/api/v1/admin/ai/incidents"
tags: ["Administration", "AI Operations", "Safety Incidents"]
---

# GET /api/v1/admin/ai/incidents

`GET /api/v1/admin/ai/incidents`

Lists the exact PostgreSQL incident queue created from critical guardrail events or explicit administrator flags. Responses contain only structured safety metadata and DLP-validated administrative notes, never transcripts or customer PII.

## Query parameters

- `assigneeAdminUserId` integer
- `conversationId` string, uuid
- `limit` integer
- `offset` integer, nullable
- `source` 'guardrail' | 'manual'
- `status` 'pending' | 'in_review' | 'confirmed_issue' | 'false_positive' | 'resolved'

## Cookies

- `billing_session` string

## Response `200`

Content-free safety incident queue.

- object
  - `generatedAt` string, date-time, required
  - `incidents` object[], required
    - `assigneeAdminUserId` integer, nullable, required
    - `claimedAt` string, date-time, nullable, required
    - `conversationId` string, uuid, required
    - `createdAt` string, date-time, required
    - `decidedAt` string, date-time, nullable, required
    - `lastActorAdminUserId` integer, nullable, required
    - `note` string, nullable, required — Content-free review rationale. Customer content, personal or payment data, credentials, links, and transcript excerpts are rejected.
    - `resolvedAt` string, date-time, nullable, required
    - `securityEventId` string, required
    - `snapshot` union, required
      - object
        - `actor` 'expert_ai' | 'triage' | 'null', nullable, required
        - `blockedReason` string, required
        - `buffered` boolean, required
        - `decision` 'allow' | 'rewrite' | 'block', required
        - `eventDatetime` string, date-time, required
        - `executionTier` 'direct_model' | 'worker' | 'justbash' | 'linux' | 'null', nullable, required
        - `judgeLatencyMs` integer, required
        - `judgeModel` string, required
        - `policyCodes` string[], required
        - `policyVersion` string, required
        - `requiresBufferedResponse` boolean, required
        - `requiresJudge` boolean, required
        - `reviewCount` integer, required
        - `rewriteCount` integer, required
        - `riskCategories` string[], required
        - `riskLevel` 'critical', required
        - `source` 'guardrail', required
        - `stage` 'input' | 'pre_tool' | 'tool_result' | 'output' | 'attachment', required
        - `submissionId` union, required
          - ''
          - string
        - `toolName` string, required
        - `traceId` string, required
      - object
        - `eventDatetime` string, date-time, required
        - `policyCode` 'ADMIN_MANUAL_FLAG', required
        - `source` 'manual', required
        - `traceId` string, required
    - `source` 'guardrail' | 'manual', required
    - `status` 'pending' | 'in_review' | 'confirmed_issue' | 'false_positive' | 'resolved', required
    - `updatedAt` string, date-time, required
    - `version` integer, required
  - `pagination` object, required
    - `hasMore` boolean, required
    - `limit` integer, required
    - `offset` integer, required
    - `total` integer, required
  - `period` object, required
    - `from` string, date-time, required
    - `to` string, date-time, required
  - `provenance` 'exact_postgres', required

## Other responses

- `400` — The filters, pagination, or session cookie are invalid.
- `401` — No valid global administrator session exists.
- `503` — The safety incident ledger is unavailable.

---

[API](https://skmtc.dev/expertschat/apis/billing-core-api.md) · [All operations](https://skmtc.dev/expertschat/apis/billing-core-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/expertschat/billing-core-api/revisions/c6d0e986ce32/schema)