> ## Documentation Index
> Fetch the complete documentation index at: https://docs.events.intrace.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List Incidents

> List incidents built from related threats

Incidents group related threats into a coherent operational story.

## Query Parameters

| Parameter  | Type      | Required | Description                                                  |
| ---------- | --------- | -------- | ------------------------------------------------------------ |
| `status`   | string    | No       | Filter by incident status                                    |
| `scope`    | string    | No       | Usually `investigation` or `aggregate`                       |
| `asset_id` | string\[] | No       | Filter incidents that include threats affecting these assets |
| `limit`    | integer   | No       | Max items                                                    |
| `offset`   | integer   | No       | Row offset                                                   |

## Response

```json theme={null}
{
  "incidents": [
    {
      "id": "309b7b4d-fbf0-4626-a512-d976ef04b94c",
      "title": "Sustained unrest around Lagos HQ",
      "status": "open",
      "scope": "aggregate",
      "threatLinks": [
        {
          "id": "5cae0d66-62dd-4940-8a27-4446538bf2f5",
          "threatId": "4f5d1cc9-d4cc-49a1-a3fc-5ec93d674bc8"
        }
      ],
      "createdAt": "2026-04-18T09:00:00Z",
      "updatedAt": "2026-04-18T11:20:00Z"
    }
  ],
  "total": 1
}
```


## OpenAPI

````yaml get /v1/incidents
openapi: 3.1.0
info:
  title: Intrace Events Monitoring API
  version: 0.1.0
  description: >
    External asset monitoring and event intelligence API derived from the
    internal

    Intrace events investigations platform.


    This public API is tenant-scoped by API key and intentionally does not
    expose

    internal identifiers such as case_id or investigation_id.
servers:
  - url: https://api.intrace.ai
security:
  - ApiKeyAuth: []
tags:
  - name: Assets
  - name: Threats
  - name: Incidents
  - name: Alerts
  - name: Reports
  - name: Event Intelligence
paths:
  /v1/incidents:
    get:
      tags:
        - Incidents
      summary: List incidents
      operationId: listIncidents
      parameters:
        - name: status
          in: query
          schema:
            type: string
            enum:
              - open
              - closed
              - resolved
        - name: scope
          in: query
          schema:
            type: string
            enum:
              - investigation
              - aggregate
        - name: asset_id
          in: query
          schema:
            oneOf:
              - type: string
              - type: array
                items:
                  type: string
          explode: true
        - $ref: '#/components/parameters/Limit'
        - $ref: '#/components/parameters/Offset'
      responses:
        '200':
          description: Incident list.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentListResponse'
components:
  parameters:
    Limit:
      name: limit
      in: query
      schema:
        type: integer
        minimum: 1
        maximum: 5000
        default: 100
    Offset:
      name: offset
      in: query
      schema:
        type: integer
        minimum: 0
        default: 0
  schemas:
    IncidentListResponse:
      type: object
      properties:
        incidents:
          type: array
          items:
            $ref: '#/components/schemas/Incident'
        total:
          type: integer
      required:
        - incidents
        - total
    Incident:
      type: object
      properties:
        id:
          type: string
          format: uuid
        title:
          type: string
        description:
          type: string
          nullable: true
        status:
          type: string
          enum:
            - open
            - closed
            - resolved
        scope:
          type: string
          enum:
            - investigation
            - aggregate
        started_at:
          type: string
          format: date-time
          nullable: true
        resolved_at:
          type: string
          format: date-time
          nullable: true
        threat_links:
          type: array
          items:
            $ref: '#/components/schemas/IncidentThreatLink'
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      required:
        - id
        - title
        - status
        - scope
        - threat_links
        - created_at
        - updated_at
    IncidentThreatLink:
      type: object
      properties:
        id:
          type: string
          format: uuid
        threat_id:
          type: string
          format: uuid
        added_at:
          type: string
          format: date-time
        threat:
          $ref: '#/components/schemas/EventSummary'
      required:
        - id
        - threat_id
        - added_at
    EventSummary:
      type: object
      properties:
        id:
          type: string
          format: uuid
        title:
          type: string
        severity:
          type: string
        threat_type:
          type: string
          nullable: true
        location:
          type: string
          nullable: true
        observed_at:
          type: string
          nullable: true
        coordinates:
          $ref: '#/components/schemas/Coordinates'
      required:
        - id
        - title
        - severity
    Coordinates:
      type: object
      properties:
        lat:
          type: number
        lng:
          type: number
      required:
        - lat
        - lng
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key

````