---
title: "Update Incident options"
method: PUT
path: "/api/v1/user/incidents/{incidentId}"
tags: ["Incidents"]
---

# Update Incident options

`PUT /api/v1/user/incidents/{incidentId}`

## Request

- Base URL: `https://urlscan.io`
- URL: `https://urlscan.io/api/v1/user/incidents/{incidentId}`
- Auth: API key in header `api-key`

Update specific runtime options of the incident

## Path parameters

- `incidentId` string, required

## Request body

- IncidentRequest
  - `incident` object, required
    - `channels` string[], required: Channels subscribed to this incident.
    - `observable` string, required: Hostname, domain, IP, or URL to observe
    - `extraPath` string, nullable: Optional path appended to hostname type incidents
    - `visibility` 'unlisted' | 'private', required: Scan visibility
    - `scanInterval` integer: Interval (seconds) between triggering full website scans.
    - `scanIntervalMode` 'manual' | 'automatic': If this is set to manual then scanIntervalAfterSuspended and scanIntervalAfterMalicious will not have an effect.
    - `watchedAttributes` string[]: Determine which items will be monitored for.
    - `userAgents` string[]: Browser User-Agents to use during scanning
    - `userAgentsPerInterval` integer: How many userAgents to use per scanInterval
    - `countries` string[]: List of countries to scan from as ISO-3166-1 country codes.
    - `countriesPerInterval` integer: How many countries to use per scan interval.
    - `stopDelaySuspended` integer: When to automatically close the incident after the observable was suspended.
    - `stopDelayInactive` integer: When to automatically close the incident after the observable became inactive.
    - `stopDelayMalicious` integer: When to automatically close the incident after the observable became malicious.
    - `scanIntervalAfterSuspended` integer: How to change the scan interval after the observable was suspended.
    - `scanIntervalAfterMalicious` integer: How to change the scan interval after the observable became malicious.
    - `incidentProfile` string: ID of the incident profile to use when creating this incident.
    - `expireAfter` integer: Seconds until the incident will automatically be closed.

## Response `200`

Incident body

- IncidentResponse
  - `incident` object
    - `_id` string: Incident ID
    - `createdAt` string, date-time: Time when the incident was created.
    - `scannedAt` string, date-time: Time when the incident was last scanned.
    - `expireAt` string, date-time: Time when the incident will be automatically closed.
    - `sourceType` 'manual' | 'api' | 'subscription' | 'fork' | 'copy': How this incident was created.
    - `sourceId` string: ID of the original item that created this incident.
    - `incidentProfile` string: ID of the incident profile to use when creating this incident.
    - `state` 'active' | 'closed': Whether the incident is active or closed
    - `stateSize` integer: Size in bytes of incident states in database.
    - `stateCount` integer: Number of stored incident states in database.
    - `owner` string: Incident owner.
    - `type` 'url' | 'ip' | 'hostname'
    - `channels` string[]: Channels subscribed to this incident.
    - `observable` string: Hostname, domain, IP, or URL to observe
    - `extraPath` string, nullable: Optional path appended to hostname type incidents
    - `visibility` 'unlisted' | 'private': Scan visibility
    - `scanInterval` integer: Interval (seconds) between triggering full website scans.
    - `scanIntervalMode` 'manual' | 'automatic': If this is set to manual then scanIntervalAfterSuspended and scanIntervalAfterMalicious will not have an effect.
    - `watchedAttributes` string[]: Determine which items will be monitored for.
    - `userAgents` string[]: Browser User-Agents to use during scanning
    - `userAgentsPerInterval` integer: How many userAgents to use per scanInterval
    - `countries` string[]: List of countries to scan from as ISO-3166-1 country codes.
    - `countriesPerInterval` integer: How many countries to use per scan interval.
    - `stopDelaySuspended` integer: When to automatically close the incident after the observable was suspended.
    - `stopDelayInactive` integer: When to automatically close the incident after the observable became inactive.
    - `stopDelayMalicious` integer: When to automatically close the incident after the observable became malicious.
    - `scanIntervalAfterSuspended` integer: How to change the scan interval after the observable was suspended.
    - `scanIntervalAfterMalicious` integer: How to change the scan interval after the observable became malicious.

---

[API](https://skmtc.dev/urlscan/apis/urlscan-io-apis.md) - [All operations](https://skmtc.dev/urlscan/apis/urlscan-io-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/urlscan/apis/urlscan-io-apis/revisions/868c1c89a6e8?raw)