---
title: "Retrieves an AI summary for the specified incident."
method: GET
path: "/v1/{accountId}/incidents/{incidentId}/ai-summary"
tags: ["Retrieve Incident AI Summary"]
---

# Retrieves an AI summary for the specified incident.

`GET /v1/{accountId}/incidents/{incidentId}/ai-summary`

## Request

- Base URL: `https://api.usa.cloud.watchguard.com/rest/threatsync/management`
- URL: `https://api.usa.cloud.watchguard.com/rest/threatsync/management/v1/{accountId}/incidents/{incidentId}/ai-summary`
- Auth: API key in header `WatchGuard-API-Key` and HTTP bearer
- TypeScript: <https://skmtc.dev/watchguard/apis/threatsync-management-api/docs/v1/:accountId/incidents/:incidentId/ai-summary/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieves the AI-generated summary and recommended actions for the ThreatSync incident specified by *incidentId*. The request runs synchronously using the same on-demand generation path as the ThreatSync UI.

You must specify the WatchGuard Cloud account that owns the incident in *accountId*. When you manage incidents for a managed account as a Service Provider, use the WatchGuard Cloud account ID of that managed account, not your Service Provider WatchGuard Cloud account ID.

This endpoint is available to Write API users.

## Path parameters

- `accountId` string, required
- `incidentId` string, required

## Response `200`

Successful response.

- IncidentAiSummary: AI-generated incident summary.
  - `accountId` string: Your WatchGuard Cloud account ID that owns the incident.
  - `incidentId` string: Unique ID that identifies the incident.
  - `state` string: Indicates summary readiness. This can be one of these values: - `ready` - The summary is available in `output`. - `pending` - Generation is in progress or facts are incomplete; call again later. - `pending_facts` - Facts are not yet available for this incident. - `facts_expired` - Source facts exceed the retention window. - `not_eligible` - The incident is not eligible for an AI summary. - `failed_fallback` - Generation fails; see `reason`.
  - `reason` string: Specifies additional detail when `state` is not `ready`.
  - `generatedAt` string: Specifies the UTC date and time when ThreatSync creates or last evaluates the summary.
  - `confidence` number, nullable: Indicates the model confidence score when `state` is `ready`.
  - `output` IncidentAiSummaryOutput: AI-generated summary text and recommended actions when `state` is `ready`.
    - `name` string: Specifies the short title for the incident.
    - `description` string: Specifies a narrative summary of the incident.
    - `actionsSummary` string: Specifies a summary of recommended response actions.
    - `recommendedActions` IncidentAiSummaryRecommendedAction[]: Lists the recommended actions ranked by priority.
      - `actionId` string: Unique ID that identifies this recommended action.
      - `target` string: Specifies the entity or resource the action applies to.
      - `rationale` string: Provides the reason this action is recommended.
      - `source` string: Indicates the source that produces the recommendation.
      - `priority` integer: Indicates relative priority; lower numbers are higher priority.
      - `commandPayload` IncidentAiSummaryCommandPayload
        - `command` string: Specifies the ThreatSync action command to perform.
        - `entityId` string: Unique ID that identifies the entity to act on.
        - `entityType` string: Specifies the type of entity.
        - `parameters` object: Contains command-specific parameters.
  - `facts` IncidentAiSummaryFacts: FACT metadata associated with the summary.
    - `factsRelevantHash` string: Provides the hash of facts used for the summary; compare with the incident `aiFactHash` to detect stale content.
    - `severity` string: Indicates the severity derived from facts.
    - `signalSources` string[]: Lists the signal sources included in the facts.
    - `lastUpdatedAt` string: Specifies the UTC date and time when ThreatSync last updates the facts.
    - `schemaVersion` string: Specifies the FACT schema version.
    - `missingTypes` string[]: Lists the FACT document types that are not yet present.

## Other responses

- `default`: Error response.

---

[API](https://skmtc.dev/watchguard/apis/threatsync-management-api.md) - [All operations](https://skmtc.dev/watchguard/apis/threatsync-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/watchguard/apis/threatsync-management-api/revisions/2993b1908d27?raw)