---
title: "List Signals"
method: GET
path: "/v1/accounts/{account_id}/signals"
tags: ["Reseller"]
---

# List Signals

`GET /v1/accounts/{account_id}/signals`

## Request

- Base URL: `https://api.huntress.io`
- URL: `https://api.huntress.io/v1/accounts/{account_id}/signals`
- Auth: `basic` (a scheme the document does not define)

Shows details of Signals belonging to the account associated with your API credentials.

Signals are used to highlight interesting user or system behaviors that an analyst can reference during a cyber investigation.
A detected Signal could be as broad and low fidelity as the detection of a command line user running whoami, or it could be as specific and high fidelity as detecting a known malware file.

## Path parameters

- `account_id` integer, required

## Query parameters

- `limit` integer
- `page_token` string
- `sort_field` 'id' | 'created_at' | 'updated_at' | 'status'
- `sort_direction` 'asc' | 'desc'
- `investigated_at_min` string
- `investigated_at_max` string
- `entity_type` 'user_entity' | 'source' | 'mailbox' | 'service_principal' | 'agent' | 'identity'
- `entity_id` string
- `organization_id` integer
- `types` string
- `statuses` string

## Response `200`

List Signals

- object
  - `signals` Signal[], required
    - `id` integer: A unique identifier for the signal.
    - `created_at` string, date-time: ISO-8601 formatted timestamp for when this signal was created.
    - `details` object: Additional details attached to this signal. These details differ based on the signal type and contain information about where the signal originated.
    - `entity` object: Additional details about the entity from which the signal originated. This will always contain an ID, Type and Name.
    - `investigated_at` string: ISO-8601 formatted timestamp for when this signal was investigated.
    - `investigation_context` string: Represents categories attached to the signal by a SOC analyst which give extra insight on the investigation.
    - `name` string: The name of the signal.
    - `organization` object: Contains information about the organization this signal came from. Includes the organization ID and name.
    - `status` string: The status of the signal. Can be one of: `reported`, `closed`
    - `type` string: The type of the signal. Can be one of: `Antivirus, Process Insights, Managed ITDR, Footholds, MDE Detections, SIEM, Ransomware Canaries, Favicon Detections, Attack Disruptions, App Control`
    - `updated_at` string, date-time: ISO-8601 formatted timestamp for when this signal was last updated.
  - `pagination` Pagination, required: Pagination model
    - `next_page_url` string
    - `next_page_token` string

## Other responses

- `403`: There was an issue with your API credential or permissions.

---

[API](https://skmtc.dev/huntress/apis/huntress-api-reference.md) - [All operations](https://skmtc.dev/huntress/apis/huntress-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/huntress/apis/huntress-api-reference/revisions/f593a257b4cc?raw)