---
title: "List Incident Reports"
method: GET
path: "/v1/accounts/{account_id}/incident_reports"
tags: ["Reseller"]
---

# List Incident Reports

`GET /v1/accounts/{account_id}/incident_reports`

## Request

- Base URL: `https://api.huntress.io`
- URL: `https://api.huntress.io/v1/accounts/{account_id}/incident_reports`
- Auth: `basic` (a scheme the document does not define)

Shows Incident Reports associated with your account.

## Path parameters

- `account_id` integer, required

## Query parameters

- `limit` integer
- `page_token` string
- `sort_field` 'id' | 'created_at' | 'updated_at'
- `sort_direction` 'asc' | 'desc'
- `indicator_type` 'footholds' | 'monitored_files' | 'ransomware_canaries' | 'antivirus_detections' | 'process_detections' | 'managed_identity' | 'mde_detections' | 'siem_detections' | 'favicon_detections' | 'behavioral_detections' | 'email_security_detections' | 'app_control' | 'ai_misuse'
- `status` 'sent' | 'closed' | 'dismissed' | 'auto_remediating' | 'deleting' | 'partner_dismissed'
- `severity` 'low' | 'high' | 'critical'
- `platform` 'windows' | 'darwin' | 'microsoft_365' | 'google' | 'linux' | 'email_security' | 'other'
- `organization_id` integer
- `agent_id` integer
- `psa_ticket_eid` string

## Response `200`

List Incident Reports

- object
  - `incident_reports` IncidentReport[], required
    - `id` integer: A unique identifier for an incident report.
    - `account_id` integer: Unique identifier for the account this incident report is associated with.
    - `agent_id` integer: Unique identifier for the agent this incident report is associated with.
    - `body` string: Autogenerated content describing the details of the incident in question.
    - `closed_at` string, date-time: ISO-8601 formatted timestamp for when this incident report had its status set to `closed`. Null if non-applicable.
    - `indicator_counts` object: Mapping of indicator types to number of incidences of that threat in the context of this incident report.
    - `indicator_types` string[]: Unique list of threat indicators that have been found in the context of this incident report.
    - `organization_id` integer: Unique identifier for the organization this incident report is associated with.
    - `platform` string: The platform of the host machine (`darwin`,`google`,`microsoft_365`,`linux`,`windows`, or `other`).
    - `psa_ticket_eids` string[]: External identifiers (EIDs) of any PSA tickets Huntress opened for this incident report — the identifier your PSA assigned to each ticket. Empty when no ticket has been opened. Use these values with the `psa_ticket_eid` filter.
    - `remediations` object: This represents an itemized list of the first 10 remediations for an incident report. If there are more than 10, use the remediations endpoint to retrieve information about them.
    - `sent_at` string, date-time: ISO-8601 formatted timestamp for when a Huntress SOC analyst has notified necessary parties regarding this incident report. Null if not sent.
    - `severity` string: The severity of the incident report. Can be one of `low`, `high`, `critical`.
    - `status` string: Status of the incident report. Can be one of `sent`, `closed`, `dismissed`, or `draft`. A `draft` report is one the Huntress SOC is still working on — for example after you rejected its remediation plan — and is only returned when fetching a report by ID.
    - `status_updated_at` string, date-time: ISO-8601 formatted timestamp for when the status of this incident report was last updated.
    - `subject` string: Autogenerated one-line description of the incident.
    - `summary` string: Details of the incident report, as provided by a Huntress SOC analyst.
    - `updated_at` string, date-time: ISO-8601 formatted timestamp for when this incident report was last updated.
  - `pagination` Pagination, required: Pagination model
    - `next_page_url` string
    - `next_page_token` string

## Other responses

- `403`: There was an issue with your API credential or permissions.

## Changes

- **2026-09-22** `7a57f91ee75e`: 1 info
  - added the new optional `query` request parameter `psa_ticket_eid`

[Operation history](https://skmtc.dev/huntress/apis/huntress-api-reference/changes/v1/accounts/:account_id/incident_reports/get.md)

---

[API](https://skmtc.dev/huntress/apis/huntress-api-reference.md) - [All operations](https://skmtc.dev/huntress/apis/huntress-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/huntress/apis/huntress-api-reference/revisions/f593a257b4cc?raw)