---
title: "Search Incidents"
method: POST
path: "/incident/v1/incidents/search"
tags: ["Incidents"]
---

# Search Incidents

`POST /incident/v1/incidents/search`

## Request

- Base URL: `https://hostname/api`
- URL: `https://hostname/api/incident/v1/incidents/search`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://{hostname}/api/access/v1/oauth/token` scopes: `INCIDENT`, `INCIDENT_READ`

Use this API to search for incidents by key terms and filters.

## Query parameters

- `page` integer
- `size` integer
- `sort` 'createdDate,asc' | 'createdDate,desc' | 'name,asc' | 'name,desc'

## Request body

- SearchCriteriaInformation
  - `filters` object: filters, which is a map of the field name and the value. Can filter on Incident Id, assignee Id, type Id, organization group Id, number, created By, is extended, is deleted
  - `fullText` string: full text search term. Can search on Incident name, description, type name, assignee name, organization group name, root cause, creator and stage name

## Response `200`

OK

- IncidentListInformation[]
  - `incidentId` string, uuid: Incident Identifier
  - `number` integer: Incident Number
  - `incidentTypeId` string, uuid: The unique identifier for the incident type.
  - `incidentTypeName` string: The name of the incident type.
  - `description` string: Incident Description
  - `sourceType` 'MANUAL' | 'ASSESSMENT' | 'WEBFORM' | 'NONE' | 'INTEGRATION': Creation Source
  - `orgGroupId` string, uuid: Organization Group Id
  - `orgGroupName` string: Organization Group Name
  - `dateOccurred` string, date-time: The date and time when the incident occurred, represented as an ISO 8601 timestamp in UTC.
  - `dateClosed` string, date-time: The date and time when the incident was closed, represented as an ISO 8601 timestamp in UTC.
  - `dateDiscovered` string, date-time: The date and time when the incident was discovered, represented as an ISO 8601 timestamp in UTC.
  - `deadline` string, date-time: The date by which the incident investigation or notification must be completed, represented as an ISO 8601 timestamp in UTC.
  - `assigneeName` string: Incident User Assignee Name
  - `totalAssessment` integer: Count of Assessment Linked to this Incident
  - `isExtended` boolean: Indicates whether the notification deadline has been extended.
  - `isDeleted` boolean: Indicates whether the incident has been deleted.
  - `createdBy` string, uuid: Incident Created User Id.
  - `creator` string: Incident Created User Name
  - `createdDate` string, date-time: The date and time when the incident was created, represented as an ISO 8601 timestamp in UTC.
  - `name` string: Incident Name
  - `openAssessment` integer: Count of Open Assessments Linked to this Incident
  - `workflowId` string, uuid: Incident Workflow Id
  - `workflowName` string: Incident Workflow Name.
  - `incidentStageId` string, uuid: Incident Stage Id
  - `incidentStageName` string: Incident Stage Name
  - `incidentStageBadgeColor` string: The badge color of the incident workflow stage.
  - `notificationNeeded` 'YES' | 'NO' | 'UNKNOWN': Incident Notification Needed
  - `incidentStatus` 'OPEN' | 'CLOSED': Incident Status
  - `attributeValues` object: Custom Attributes

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `429`: Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).
- `500`: Internal Server Error

---

[API](https://skmtc.dev/onetrust/apis/privacy-automation-incident-management.md) - [All operations](https://skmtc.dev/onetrust/apis/privacy-automation-incident-management/llms.txt) - [OpenAPI document](https://skmtc.dev/onetrust/apis/privacy-automation-incident-management/revisions/73e6e54c0682?raw)