> ## Documentation Index > Fetch the complete documentation index at: https://docs.igrisecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Get an incident > Returns an incident with its policy, its impact (events blocked, allowed and redacted) and a 12-hour pulse of hourly event counts. **Required permission:** `alerts:read` ## OpenAPI ````yaml /api-reference/openapi.yaml get /api/v1/incidents/{id} openapi: 3.1.0 info: title: Igris Management API version: '1' description: >- REST API for managing Igris connections, policies, sessions, audit events and alerts. servers: - url: https://api.igrisecurity.com security: - bearerAuth: [] tags: - name: Connections - name: Policies - name: Sessions - name: Audit Events - name: Incidents - name: Webhooks - name: API Keys - name: Members - name: LLM Providers - name: LLM Cost - name: Observe paths: /api/v1/incidents/{id}: get: tags: - Incidents summary: Get an incident description: > Returns an incident with its policy, its impact (events blocked, allowed and redacted) and a 12-hour pulse of hourly event counts. **Required permission:** `alerts:read` operationId: getIncident parameters: - $ref: '#/components/parameters/Id' responses: '200': description: The incident and its context. content: application/json: schema: type: object properties: data: type: object properties: incident: $ref: '#/components/schemas/Incident' policy: type: - object - 'null' properties: id: type: string format: uuid name: type: string rules: type: array items: $ref: '#/components/schemas/PolicyRule' impact: type: object properties: blocked: type: integer allowed: type: integer redacted: type: integer pulse: type: array description: 12 hourly buckets, oldest first. items: type: object properties: bucket: type: string format: date-time count: type: integer example: data: incident: id: 2b3c4d5e-0000-4000-8000-000000000008 title: 'Denied: delete_repo on github-prod' status: investigating severity: medium category: denial policyName: Block delete tools eventCount: 3 firstSeen: '2026-01-01T00:00:00Z' lastSeen: '2026-01-01T00:40:00Z' policy: id: 7b1d4c2e-0000-4000-8000-000000000002 name: Block delete tools rules: - target: kind: mcp_tool tool: delete_* action: deny impact: blocked: 3 allowed: 0 redacted: 0 pulse: - bucket: '2026-01-01T00:00:00.000Z' count: 3 - bucket: '2026-01-01T01:00:00.000Z' count: 0 '400': description: The id is not a UUID. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Invalid incident id '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' components: parameters: Id: name: id in: path required: true schema: type: string format: uuid schemas: Incident: type: object properties: id: type: string format: uuid organizationId: type: string clusterKey: type: string title: type: string summary: type: string status: type: string enum: - open - investigating - resolved severity: type: string enum: - critical - high - medium - low - info severityLocked: type: boolean description: >- True once someone set the severity by hand. A locked severity is not auto-escalated. category: type: string enum: - denial - anomaly - session anomalyType: type: - string - 'null' description: Snake_case anomaly detector id such as `rate_spike`.: null policyId: type: - string - 'null' format: uuid policyName: type: - string - 'null' actorKind: type: - string - 'null' actorId: type: - string - 'null' actorName: type: - string - 'null' connectionSlug: type: - string - 'null' suggestedAction: type: - string - 'null' resolutionNote: type: - string - 'null' eventCount: type: integer firstSeen: type: string format: date-time lastSeen: type: string format: date-time resolvedAt: type: - string - 'null' format: date-time createdAt: type: string format: date-time updatedAt: type: string format: date-time PolicyRule: type: object required: - target - action properties: target: $ref: '#/components/schemas/PolicyRuleTarget' action: type: string enum: - allow - deny - alert - redact conditions: type: object description: > When the rule applies. Keys can only be `user` or `metadata.`; any other key returns `422`. A value is a string (exact match) or one of `{ eq }`, `{ neq }`, `{ in: [...] }`, `{ nin: [...] }`. additionalProperties: oneOf: - type: string - type: object properties: eq: type: string - type: object properties: neq: type: string - type: object properties: in: type: array items: type: string - type: object properties: nin: type: array items: type: string example: user: alice@company.com metadata.env: in: - prod - staging limit: type: object description: >- Rate limit. Applies to LLM rules only; on an `mcp_tool` rule it returns `422`. required: - per properties: requests: type: number exclusiveMinimum: 0 tokens: type: number exclusiveMinimum: 0 dollars: type: number exclusiveMinimum: 0 per: type: string enum: - minute - hour - day tokenGuard: type: object properties: maxInputTokens: type: number exclusiveMinimum: 0 maxOutputTokens: type: number exclusiveMinimum: 0 maxRequestMaxTokens: type: number exclusiveMinimum: 0 contentGuard: type: object description: Content detectors to run. See [Guards](/govern/guards). required: - detectors - action properties: detectors: type: array minItems: 1 maxItems: 50 items: type: string minLength: 1 maxLength: 80 action: type: string enum: - deny - redact - alert inspectResponse: type: boolean logContent: type: boolean Error: type: object required: - error properties: error: type: string PolicyRuleTarget: description: What the rule matches. oneOf: - type: object title: MCP tool required: - kind - tool properties: kind: type: string const: mcp_tool tool: type: string minLength: 1 description: Tool name. `*` wildcards are allowed. example: delete_* - type: object title: LLM model required: - kind - model properties: kind: type: string const: llm_model model: type: string minLength: 1 example: gpt-4o* - type: object title: LLM endpoint required: - kind - endpoint properties: kind: type: string const: llm_endpoint endpoint: type: string enum: - chat.completions - embeddings - images.generate - audio.transcriptions - audio.speech - passthrough ForbiddenError: type: object properties: error: type: string example: Forbidden required: type: string description: The permission the caller lacks. example: policies:write responses: Unauthorized: description: No valid session or API key, or the key's creator is no longer a member. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Unauthorized Forbidden: description: The caller lacks the required permission. content: application/json: schema: $ref: '#/components/schemas/ForbiddenError' NotFound: description: Not found. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Not found securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: ig_... description: >- An Igris API key. It acts with the current role and permission overrides of the member who created it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.