> ## Documentation Index
> Fetch the complete documentation index at: https://docs.events.intrace.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Incident Activity

> Return the derived incident timeline

Returns a merged timeline of:

* threat-link activity
* threat-version activity for linked threats

## Query Parameters

| Parameter                      | Type    | Required | Description                                                                               |
| ------------------------------ | ------- | -------- | ----------------------------------------------------------------------------------------- |
| `include_versions_before_link` | boolean | No       | Include historical threat versions created before the threat was linked into the incident |


## OpenAPI

````yaml get /v1/incidents/{incident_id}/activity
openapi: 3.1.0
info:
  title: Intrace Events Monitoring API
  version: 0.1.0
  description: >
    External asset monitoring and event intelligence API derived from the
    internal

    Intrace events investigations platform.


    This public API is tenant-scoped by API key and intentionally does not
    expose

    internal identifiers such as case_id or investigation_id.
servers:
  - url: https://api.intrace.ai
security:
  - ApiKeyAuth: []
tags:
  - name: Assets
  - name: Threats
  - name: Incidents
  - name: Alerts
  - name: Reports
  - name: Event Intelligence
paths:
  /v1/incidents/{incident_id}/activity:
    get:
      tags:
        - Incidents
      summary: Get incident activity
      operationId: getIncidentActivity
      parameters:
        - $ref: '#/components/parameters/IncidentId'
        - name: include_versions_before_link
          in: query
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Incident timeline.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentActivityListResponse'
components:
  parameters:
    IncidentId:
      name: incident_id
      in: path
      required: true
      schema:
        type: string
        format: uuid
  schemas:
    IncidentActivityListResponse:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/IncidentActivityItem'
        total:
          type: integer
      required:
        - items
        - total
    IncidentActivityItem:
      type: object
      properties:
        kind:
          type: string
        at:
          type: string
          format: date-time
        threat_id:
          type: string
          format: uuid
        link_id:
          type: string
          format: uuid
          nullable: true
        threat_version:
          type: object
          additionalProperties: true
          nullable: true
      required:
        - kind
        - at
        - threat_id
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key

````