---
title: "Incident Report"
method: POST
path: "/identity/incident/report"
tags: ["Credentials"]
---

# Incident Report

`POST /identity/incident/report`

## Request

- Base URL: `https://api.recordedfuture.com`
- URL: `https://api.recordedfuture.com/identity/incident/report`
- Auth: one of:
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`
  - API key in header `X-RFToken`

Get a detailed exposure incident report for a single malware log, including compromised credentials, device details, and malware attribution.

## Request body

- IncidentReportRequest
  - `organization_id` string
  - `source` string, required: The dump source identifier (e.g., dump-redline-2024-07-21-001)
  - `include_details` boolean, required: Include extended device and malware details in the response
  - `limit` integer: Maximum number of credential entries to return
  - `offset` string: Pagination token for next page

## Response `200`

Success

- IncidentReportResponse
  - `count` integer, required
  - `total_count` integer, required
  - `credentials` IncidentReportCredentials[], required
    - `authorization_domain` string
    - `email_or_login` string, required
    - `password` string, required
    - `password_sha1` string
    - `domain_category` string
    - `domain_technology` string
    - `contains_cookies` boolean, required
    - `contains_active_cookies` boolean, required
    - `contains_high_risk_technologies` boolean, required
  - `details` IncidentReportDetails
    - `malware_family` string
    - `os` string
    - `os_username` string
    - `malware_file` string
    - `timezone` string
    - `uac` string
    - `exfiltration_date` string, date-time
    - `antivirus` string
    - `ip_address` string
    - `postal_code` string
    - `country` string
  - `next_offset` string

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `500`: Internal Server Error
- `default`: Error

---

[API](https://skmtc.dev/recordedfuture/apis/recorded-future-identity-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-identity-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-identity-api/revisions/95e20835fe80?raw)