---
title: "List Detection Groups Route"
method: GET
path: "/api/v1/detection-groups"
---

# List Detection Groups Route

`GET /api/v1/detection-groups`

## Request

- Base URL: `https://api.stacktrace.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.stacktrace.ai/api/v1/detection-groups`
- Auth: none declared

The same population as `/detections`, one row per (agent, rule, components).

A sibling rather than a mode on `/detections`, because the two return
different shapes and a response whose fields depend on a query parameter is
a contract a client cannot type. Every filter is identical, so a reader can
move between the views without the numbers moving under them.

## Query parameters

- `cursor` string, nullable
- `limit` integer
- `severity` string, nullable
- `family` string, nullable
- `rule_id` string, nullable
- `agent_kind` string, nullable
- `agent_id` string, nullable
- `asset_id` string, nullable
- `status` string, nullable
- `component` string, nullable
- `window` '1d' | '3d' | '7d' | '30d' | 'all', nullable

## Headers

- `authorization` string, nullable

## Response `200`

Successful Response

- DetectionGroupsResponse: `total` counts **groups**, not detections. The detection count lives in `summary.by_rule`, deliberately a different number: one says how many distinct (agent, rule, component set) problems exist, the other how many times they fired. Both are on the page because a reader needs both.
  - `items` DetectionGroupRow[], required
    - `rule_id` string, required
    - `title` string, nullable
    - `family` string, nullable
    - `severity` string, required
    - `detections` integer, required
    - `sessions` integer, required
    - `agent_finding_sessions` integer, required
    - `first_session_at` string, nullable
    - `last_session_at` string, nullable
    - `component` string, required
    - `component_label` string, nullable
    - `subject_kind` string, nullable
    - `component_type` string, nullable
    - `agent_id` string, required
    - `agent_kind` string, required
    - `agent_instance_id` string, nullable
    - `asset_id` string, required
    - `asset_display_name` string, required
    - `people` PersonRef[]
      - `person` string, required
      - `name` string, required
  - `next_cursor` string, nullable
  - `total` integer, required
  - `summary` DetectionsSummary: Computed over the whole filtered result, never over the page. Every number here answers for the rows the caller's filters selected, so none of them is named for a grade: under `status=resolved` a field called `open_*` would carry a resolved count. The row total the console captions lives on the response as `total`.
    - `by_severity` DetectionSeverityCounts: Three grades, not four. Detect emits no `critical` (its ADR-0010).
      - `high` integer
      - `medium` integer
      - `low` integer
    - `by_family` object
    - `uncatalogued_family_detections` integer
    - `by_rule` RuleCount[]
      - `rule_id` string, required
      - `title` string, nullable
      - `detections` integer, required
    - `agents_affected` integer
    - `sessions_affected` integer
    - `coverage` RuntimeCoverage: Derived by summing activity, never transmitted (ADR-0027). `resolved` counts calls the correlator could place. A low rate means the detector could not *read* those sessions — not that they were clean.
      - `total` integer
      - `resolved` integer
    - `denied_attempts` integer
    - `has_detect_run` boolean

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/stacktrace/apis/stacktrace-fleet-api.md) - [All operations](https://skmtc.dev/stacktrace/apis/stacktrace-fleet-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stacktrace/apis/stacktrace-fleet-api/revisions/0ee5484d1d0b?raw)