HUhuntress
Escalations

List Escalations

Changed on

Shows Escalations associated with your account. Additional details for a specific escalation can be obtained by using the GET Escalation endpoint.

Escalations are used to notify Huntress account administrators that a situation requires their attention. Below are some common use cases:

  • Security Operation Centers (SOC) suspect that an application being flagged as malicious is a false positive, and we want to get your authorization to allow-list the application moving forward.
  • A potential threat flagged by Managed Defender requires additional information (file path details, etc.) in order for Huntress to provide actionable assisted remediation steps.
  • A login event occurred from an unexpected country or VPN, and Huntress would like partner feedback on whether that event should be expected or unauthorized.

Though Escalations are not incident reports, they do have severities (low, high, critical) associated with them that dictate an expected response time.

get/v1/escalations

Request

  • Base URL
    https://api.huntress.io
  • URL
    https://api.huntress.io/v1/escalations
  • Auth
    basic (a scheme the document does not define)

Query parameters

limitinteger

Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.

page_tokenstring

Token used to request the next page in paginated results. Defaults to 'null'

sort_field'id' | 'severity' | 'due_at' | 'created_at' | 'updated_at'

Field to sort by. Defaults to 'id'.

sort_direction'asc' | 'desc'

Sort direction. Defaults to 'desc'.

status'open' | 'overdue' | 'resolved'

Filter by status.

severity'low' | 'high' | 'critical'

Filter by severity.

subtypestring

Filter by subtype.

organization_idinteger

Filter by organization ID.

psa_ticket_eidstring

Filter by the external identifier (EID) of a ticket Huntress opened in your PSA — the identifier your PSA assigned to the ticket. Depending on the PSA, this may differ from the ticket number a technician sees.

Matches the Escalation the ticket was opened for, whether Huntress opened a single ticket for the whole Escalation or a separate ticket for each entity attached to it. Tickets Huntress opened for anything other than an Escalation, such as an incident report, will not match.

Response

List Escalations

Example response

{
  "escalations": [
    {
      "id": 84938,
      "account": {
        "id": 1,
        "name": "Your Account Name"
      },
      "organizations": [
        {
          "id": 1234,
          "name": "ExampleCo"
        }
      ],
      "created_at": "2025-09-05T18:20:34Z",
      "resolved_at": "2025-09-05T18:20:34Z",
      "severity": "low",
      "status": "resolved",
      "subject": "Defender Disabled",
      "subtype": "US",
      "type": "Environmental Issue",
      "type_code": "unexpected_country_access",
      "psa_ticket_eids": [
        "T-1696"
      ],
      "updated_at": "2025-09-05T18:20:34Z"
    }
  ]
}

Changes