List incidents

curl --request GET \
  --url https://api.igrisecurity.com/api/v1/incidents \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.igrisecurity.com/api/v1/incidents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.igrisecurity.com/api/v1/incidents"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

{
  "data": [
    {
      "id": "2b3c4d5e-0000-4000-8000-000000000007",
      "title": "Anomaly: rate spike on github-prod",
      "summary": "Tool calls on github-prod are 6x above baseline.",
      "status": "open",
      "severity": "high",
      "category": "anomaly",
      "anomalyType": "rate_spike",
      "connectionSlug": "github-prod",
      "policyName": null,
      "suggestedAction": null,
      "resolutionNote": null,
      "eventCount": 14,
      "firstSeen": "2026-01-01T00:00:00Z",
      "lastSeen": "2026-01-01T01:00:00Z",
      "resolvedAt": null
    }
  ],
  "meta": {
    "total": 1,
    "limit": 50,
    "offset": 0,
    "nextCursor": null
  }
}

{
  "error": "Unauthorized"
}

{
  "error": "Forbidden",
  "required": "policies:write"
}