---
title: "Get Incident Report"
method: GET
path: "/v1/accounts/{account_id}/incident_reports/{id}"
tags: ["Reseller"]
---

# Get Incident Report

`GET /v1/accounts/{account_id}/incident_reports/{id}`

## Request

- Base URL: `https://api.huntress.io`
- URL: `https://api.huntress.io/v1/accounts/{account_id}/incident_reports/{id}`
- Auth: `basic` (a scheme the document does not define)

Shows details on a single Incident Report associated with your account.

Unlike the list endpoint, this includes Incident Reports that have been sent back to the Huntress SOC — for example after their remediation plan was rejected — which report a `status` of `draft`.

## Path parameters

- `account_id` integer, required
- `id` integer, required

## Response `200`

Get Incident Report

- object
  - `incident_report` IncidentReport: IncidentReport model
    - `id` integer: A unique identifier for an incident report.
    - `account_id` integer: Unique identifier for the account this incident report is associated with.
    - `agent_id` integer: Unique identifier for the agent this incident report is associated with.
    - `body` string: Autogenerated content describing the details of the incident in question.
    - `closed_at` string, date-time: ISO-8601 formatted timestamp for when this incident report had its status set to `closed`. Null if non-applicable.
    - `indicator_counts` object: Mapping of indicator types to number of incidences of that threat in the context of this incident report.
    - `indicator_types` string[]: Unique list of threat indicators that have been found in the context of this incident report.
    - `organization_id` integer: Unique identifier for the organization this incident report is associated with.
    - `platform` string: The platform of the host machine (`darwin`,`google`,`microsoft_365`,`linux`,`windows`, or `other`).
    - `psa_ticket_eids` string[]: External identifiers (EIDs) of any PSA tickets Huntress opened for this incident report — the identifier your PSA assigned to each ticket. Empty when no ticket has been opened. Use these values with the `psa_ticket_eid` filter.
    - `remediations` object: This represents an itemized list of the first 10 remediations for an incident report. If there are more than 10, use the remediations endpoint to retrieve information about them.
    - `sent_at` string, date-time: ISO-8601 formatted timestamp for when a Huntress SOC analyst has notified necessary parties regarding this incident report. Null if not sent.
    - `severity` string: The severity of the incident report. Can be one of `low`, `high`, `critical`.
    - `status` string: Status of the incident report. Can be one of `sent`, `closed`, `dismissed`, or `draft`. A `draft` report is one the Huntress SOC is still working on — for example after you rejected its remediation plan — and is only returned when fetching a report by ID.
    - `status_updated_at` string, date-time: ISO-8601 formatted timestamp for when the status of this incident report was last updated.
    - `subject` string: Autogenerated one-line description of the incident.
    - `summary` string: Details of the incident report, as provided by a Huntress SOC analyst.
    - `updated_at` string, date-time: ISO-8601 formatted timestamp for when this incident report was last updated.

## Other responses

- `403`: There was an issue with your API credential or permissions.

---

[API](https://skmtc.dev/huntress/apis/huntress-api-reference.md) - [All operations](https://skmtc.dev/huntress/apis/huntress-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/huntress/apis/huntress-api-reference/revisions/f593a257b4cc?raw)