Get an incident

curl --request GET \
  --url https://api.igrisecurity.com/api/v1/incidents/{id} \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.igrisecurity.com/api/v1/incidents/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.igrisecurity.com/api/v1/incidents/{id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

{
  "data": {
    "incident": {
      "id": "2b3c4d5e-0000-4000-8000-000000000008",
      "title": "Denied: delete_repo on github-prod",
      "status": "investigating",
      "severity": "medium",
      "category": "denial",
      "policyName": "Block delete tools",
      "eventCount": 3,
      "firstSeen": "2026-01-01T00:00:00Z",
      "lastSeen": "2026-01-01T00:40:00Z"
    },
    "policy": {
      "id": "7b1d4c2e-0000-4000-8000-000000000002",
      "name": "Block delete tools",
      "rules": [
        {
          "target": {
            "kind": "mcp_tool",
            "tool": "delete_*"
          },
          "action": "deny"
        }
      ]
    },
    "impact": {
      "blocked": 3,
      "allowed": 0,
      "redacted": 0
    },
    "pulse": [
      {
        "bucket": "2026-01-01T00:00:00.000Z",
        "count": 3
      },
      {
        "bucket": "2026-01-01T01:00:00.000Z",
        "count": 0
      }
    ]
  }
}

{
  "error": "Invalid incident id"
}

{
  "error": "Unauthorized"
}

{
  "error": "Forbidden",
  "required": "policies:write"
}

{
  "error": "Not found"
}