WAwatchguard
Retrieve Incident AI Summary

Retrieves an AI summary for the specified incident.

Retrieves the AI-generated summary and recommended actions for the ThreatSync incident specified by incidentId. The request runs synchronously using the same on-demand generation path as the ThreatSync UI.

You must specify the WatchGuard Cloud account that owns the incident in accountId. When you manage incidents for a managed account as a Service Provider, use the WatchGuard Cloud account ID of that managed account, not your Service Provider WatchGuard Cloud account ID.

This endpoint is available to Write API users.

get/v1/{accountId}/incidents/{incidentId}/ai-summary

Request

Path parameters

accountIdstring required

Your WatchGuard Cloud Account ID.

incidentIdstring required

ID of an incident.

Response

Successful response.

accountIdstring

Your WatchGuard Cloud account ID that owns the incident.

incidentIdstring

Unique ID that identifies the incident.

statestring

Indicates summary readiness. This can be one of these values:

  • ready - The summary is available in output.
  • pending - Generation is in progress or facts are incomplete; call again later.
  • pending_facts - Facts are not yet available for this incident.
  • facts_expired - Source facts exceed the retention window.
  • not_eligible - The incident is not eligible for an AI summary.
  • failed_fallback - Generation fails; see reason.
reasonstring

Specifies additional detail when state is not ready.

generatedAtstring

Specifies the UTC date and time when ThreatSync creates or last evaluates the summary.

confidencenumber nullable

Indicates the model confidence score when state is ready.

Example response

{
  "accountId": "WCG-1-123abc456 or ACC-1234567",
  "incidentId": "cg0f0s2h7skomt847f1g",
  "state": "ready",
  "reason": "facts_not_written",
  "generatedAt": "2026-09-30T22:13:35.874527+00:00",
  "confidence": 0.92,
  "output": {
    "name": "Suspicious PowerShell activity on endpoint",
    "recommendedActions": [
      {
        "commandPayload": {
          "command": "isolate",
          "entityType": "endpoint"
        }
      }
    ]
  },
  "facts": {
    "severity": "High"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.