---
title: "Retrieves a list of incidents."
method: GET
path: "/v1/{accountId}/incidents"
tags: ["Get Incidents"]
---

# Retrieves a list of incidents.

`GET /v1/{accountId}/incidents`

## Request

- Base URL: `https://api.usa.cloud.watchguard.com/rest/threatsync/management`
- URL: `https://api.usa.cloud.watchguard.com/rest/threatsync/management/v1/{accountId}/incidents`
- Auth: API key in header `WatchGuard-API-Key` and HTTP bearer
- TypeScript: <https://skmtc.dev/watchguard/apis/threatsync-management-api/docs/v1/:accountId/incidents/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieves a list of specific ThreatSync incidents for an account.

## Path parameters

- `accountId` string, required

## Query parameters

- `query` string
- `sortBy` string
- `sortOrder` string
- `groupBy` string
- `fields` string
- `countOnly` boolean
- `limit` integer
- `startAfter` string
- `duration` string
- `tenants` boolean
- `includeActions` boolean
- `includeComments` boolean

## Response `200`

Successful response.

- FetchIncidents: Get incident response.
  - `items` union[]: List of incidents.
    - union
      - Incident: Incident information.
        - `id` string: ID of the incident.
        - `account` string: Account ID.
        - `category` string: Category of the incident.
        - `type` string: Specific type of incident within an incident category.
        - `timestamp` string: Date and time the incident was created.
        - `threatScore` integer: Threat score of incident.
        - `severity` string: The severity of the incident. Possible values are Low, Medium, High, and Critical.
        - `description` string: A description of the incident.
        - `remediated` boolean: Remediation status of the incident.
        - `entities` object: Details of the entity that the incident belongs to.
          - `8ed6cbce746d4597A6469bbc0c4edce9` object: Entity data.
            - `type` string: Type of entity.
            - `recommendedActions` object[]: List of recommended actions.
              - …
            - `actionPerformed` object: Information about an action that was performed at the source in response to the event.
              - …
            - `threatDetails` object: Threat details of an incident.
              - …
        - `entityIds` string[]
        - `status` string: Specifies the status of the incident. This can be one of these values: - new - New incidents not yet reviewed. - read - Reviewed incidents or incidents marked as read. - closed - Incidents closed by an automation policy or manually closed.
        - `lastUpdateTime` string: The date and time (in UTC) when the incident status was last changed.
        - `updatedBy` string: The name of the operator that updated the incident status. Or "system" if the update was in response to an automated action.
      - IncidentWithActions: Action information.
        - `id` string: ID of an action.
        - `account` string: Account ID.
        - `category` string: Category of the incident.
        - `type` string: Identifies whether an action was performed manually or through an automation policy.
        - `timestamp` string: Date and time the incident was created.
        - `threatScore` integer: Threat score of incident.
        - `severity` string: The severity of the incident. Possible values are Low, Medium, High, and Critical.
        - `description` string: A description of the incident.
        - `remediated` boolean: Remediation status of the incident.
        - `entities` object: Details of the entity that the incident belongs to.
          - `8ed6cbce746d4597A6469bbc0c4edce9` object: Entity data.
            - `type` string: Type of entity.
            - `recommendedActions` object[]: List of recommended actions.
              - …
            - `actionPerformed` object: Information about an action that was performed at the source in response to the event.
              - …
            - `threatDetails` object: Threat details of an incident.
              - …
        - `entityIds` string[]
        - `status` string: Specifies the status of the incident. This can be one of these values: - new - New incidents not yet reviewed. - read - Reviewed incidents or incidents marked as read. - closed - Incidents closed by an automation policy or manually closed.
        - `lastUpdateTime` string: Last updated time of the action.
        - `updatedBy` string: The name of the operator that updated the incident status. Or "system" if the update was in response to an automated action.
        - `entityId` string: ID of the entity.
        - `entityType` string: The type of entity.
        - `parameters` object: Parameters required to perform the action. These depend on the specified action.
          - `address` string: The IP address to block.
        - `irreversible` boolean: Indicates whether the action is reversible.
        - `responder` string: Indicates whether the action was initiated at the source, initiated manually, or initiated by an automation policy.
        - `creationTime` string: The time the action was created.
        - `command` string: The name of the action performed.
        - `initiatedBy` string: The name of the operator who initiated the action.
      - IncidentWithComments: Incident information.
        - `id` string: ID of the incident.
        - `account` string: Account ID.
        - `category` string: Category of the incident.
        - `type` string: Specific type of incident within an incident category.
        - `timestamp` string: Date and time the incident was created.
        - `threatScore` integer: Threat score of incident.
        - `severity` string: The severity of the incident. Possible values are Low, Medium, High, and Critical.
        - `description` string: A description of the incident.
        - `remediated` boolean: Remediation status of the incident.
        - `entities` object: Details of the entity that the incident belongs to.
          - `8ed6cbce746d4597A6469bbc0c4edce9` object: Entity data.
            - `type` string: Type of entity.
            - `recommendedActions` object[]: List of recommended actions.
              - …
            - `actionPerformed` object: Information about an action that was performed at the source in response to the event.
              - …
            - `threatDetails` object: Threat details of an incident.
              - …
        - `entityIds` string[]
        - `status` string: Specifies the status of the incident. This can be one of these values: - new - New incidents not yet reviewed. - read - Reviewed incidents or incidents marked as read. - closed - Incidents closed by an automation policy or manually closed.
        - `lastUpdateTime` string: The date and time (in UTC) when the incident status was last changed.
        - `updatedBy` string: The name of the operator that updated the incident status. Or "system" if the update was in response to an automated action.
        - `comments` union[]: List of comments.
          - union
            - Comment: Create a comment for a specific incident.
              - …
            - union
              - …
            - CommentWithIncidentTransition: Create a comment for a specific incident.
              - …
            - CommentWithActionTransition: Create a comment for a specific incident.
              - …
  - `count` integer: Total count of incidents.

## Other responses

- `default`: Error response.

---

[API](https://skmtc.dev/watchguard/apis/threatsync-management-api.md) - [All operations](https://skmtc.dev/watchguard/apis/threatsync-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/watchguard/apis/threatsync-management-api/revisions/2993b1908d27?raw)