Skip to main content
POST
Export reporting facts

Body

application/json

One fact type over the range with its optional filters: every row, as the export reads them.

type
null | string
required

The fact type: detection, closure, investigation, feedback, sla-result, sla-transition, assignment or response-action.

from
string<date>
required

The first day of the range, inclusive (UTC days). A range spans at most 366 days.

to
string<date>
required

The last day of the range, inclusive (UTC days).

closerType
null | string

Closure facts only: who closed the incident.

outcome
null | string

Investigation and response-action facts only: how the run ended.

severity
null | string

The incident's severity.

verdict
null | string

Investigation facts only: the agent's verdict.

rule
null | string

Closure facts only: the rule, as the incident title.

slaType
null | string

SLA state changes only: the clock, Slo or Mttr.

tier
null | string

SLA state changes only: the tier the clock moved to, AtRisk, Breached or Met.

workspaceIds
null | string<uuid>[]

The workspaces to read, at most 500; null or empty reads every workspace the caller may see. A service account sees the workspaces it holds a role on.

Response

OK

Standard v2 API response envelope for single-item responses.

data
object

Every row behind a report, as a table with the columns of its fact type.

meta
object