Skip to main content
GET
/
v1
/
incidents
Get incidents
curl --request GET \
  --url https://api.petrasecurity.com/v1/incidents \
  --header 'Authorization: Bearer <token>'
{
  "incidents": [
    {
      "id": "48f3708e-45c1-4902-9e3b-26165bf3d76a",
      "url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/48f3708e-45c1-4902-9e3b-26165bf3d76a",
      "createdAt": "2025-02-06T03:55:06.050Z",
      "occurredAt": "2025-02-04T22:14:12.000Z",
      "remediationStatus": "REMEDIATED",
      "isLive": false,
      "dwellTimeMinutes": 1918.650583333333,
      "tenant": {
        "petraTenantId": "ZZk90t",
        "name": "Acme Corp.",
        "microsoftTenantId": "a1b2c3d4-5e6f-7890-abcd-ef1234567890"
      },
      "user": {
        "id": "2e8c5169-af3d-447b-9c4f-82d516b9fe34",
        "userPrincipalName": "askywalker@acmecorp.com",
        "mail": "askywalker@acmecorp.com",
        "displayName": "Anakin Skywalker",
        "accountEnabled": true,
        "lastPasswordChangeDateTime": null
      }
    },
    {
      "id": "0c207800-80d0-46ed-beec-376779e33bbb",
      "url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/0c207800-80d0-46ed-beec-376779e33bbb",
      "createdAt": "2025-02-05T23:38:05.705Z",
      "occurredAt": "2025-02-05T23:33:29.000Z",
      "remediationStatus": "REMEDIATED",
      "isLive": true,
      "dwellTimeMinutes": 5.923883333333333,
      "tenant": {
        "petraTenantId": "ZZk90t",
        "name": "Acme Corp.",
        "microsoftTenantId": "a1b2c3d4-5e6f-7890-abcd-ef1234567890"
      },
      "user": {
        "id": "7a3fd851-bc4e-489c-b6d2-35f940d7ace2",
        "userPrincipalName": "ncaffrey@acmecorp.com",
        "mail": "ncaffrey@acmecorp.com",
        "displayName": "Neal Caffrey",
        "accountEnabled": true,
        "lastPasswordChangeDateTime": "2024-01-23T18:52:24.000Z"
      }
    },
    {
      "id": "6f604112-3dbc-4c85-9a87-e451e58d0286",
      "url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/6f604112-3dbc-4c85-9a87-e451e58d0286",
      "createdAt": "2025-01-26T14:02:43.050Z",
      "occurredAt": "2025-01-22T22:20:57.000Z",
      "remediationStatus": "REMEDIATED",
      "isLive": false,
      "dwellTimeMinutes": 656634.6116,
      "tenant": {
        "petraTenantId": "ZZk90t",
        "name": "Acme Corp.",
        "microsoftTenantId": "a1b2c3d4-5e6f-7890-abcd-ef1234567890"
      },
      "user": {
        "id": "0e50012e-ada7-42fa-bca2-754070f958a3",
        "userPrincipalName": "nick.renner@acmecorp.com",
        "mail": "nick.renner@acmecorp.com",
        "displayName": "Nick Renner",
        "accountEnabled": true,
        "lastPasswordChangeDateTime": null
      }
    },
    {
      "id": "a212087c-bc60-4fbc-8bf5-5a4c2f823e5f",
      "url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/a212087c-bc60-4fbc-8bf5-5a4c2f823e5f",
      "createdAt": "2025-01-20T12:33:15.000Z",
      "occurredAt": "2025-01-20T12:28:47.000Z",
      "remediationStatus": "REMEDIATED",
      "isLive": true,
      "dwellTimeMinutes": 4.55,
      "tenant": {
        "petraTenantId": "ZZk90t",
        "name": "Acme Corp.",
        "microsoftTenantId": "a1b2c3d4-5e6f-7890-abcd-ef1234567890"
      },
      "user": {
        "id": "01be85ac-1cbd-47a4-bead-47fc8c2c65da",
        "userPrincipalName": "asha.streich@acmecorp.com",
        "mail": "asha.streich@acmecorp.com",
        "displayName": "Asha Streich",
        "accountEnabled": true,
        "lastPasswordChangeDateTime": "2025-02-04T20:35:25.000Z"
      }
    }
  ]
}
For common API errors, see API Troubleshooting.
This route is limited to 10 requests per minute.

Authorizations

​
Authorization
string
header
required

Bearer token authentication. Include your API key in the Authorization header as 'Bearer YOUR_API_KEY'

Query Parameters

​
tenantId
string

Filter incidents to a specific tenant. Accepts either a Petra tenant ID or a Microsoft tenant ID. You can find a tenant's Petra ID in the URL when viewing a tenant in the dashboard (e.g. app.petrasecurity.com/tenant/). You can also pass a Microsoft tenant ID and the endpoint will resolve it automatically.

​
startDate
string<date-time>

Only return incidents created on or after this date. Accepts ISO 8601 format — either date only (e.g. 2026-03-01) or full date-time (e.g. 2026-03-05T00:53:10.402Z).

​
limit
integer
default:100

Maximum number of incidents to return. Defaults to 100, maximum 500.

Required range: 1 <= x <= 500

Response

Successful response

​
incidents
object[]

Array of incident objects