Skip to main content
POST
Get reporting facts

Body

application/json

One page of facts: the filters, plus the page size and where the previous page stopped.

type
null | string
required

The fact type: detection, closure, investigation, feedback, sla-result, sla-transition, assignment or response-action.

from
string<date>
required

The first day of the range, inclusive (UTC days). A range spans at most 366 days.

to
string<date>
required

The last day of the range, inclusive (UTC days).

pageSize

Rows per page, from 1 to 200; 50 when omitted. A page can hold fewer rows while a token remains.

continuationToken
null | string

The previous page's token; omitted for the first page.

closerType
null | string

Closure facts only: who closed the incident.

outcome
null | string

Investigation and response-action facts only: how the run ended.

severity
null | string

The incident's severity.

verdict
null | string

Investigation facts only: the agent's verdict.

rule
null | string

Closure facts only: the rule, as the incident title.

slaType
null | string

SLA state changes only: the clock, Slo or Mttr.

tier
null | string

SLA state changes only: the tier the clock moved to, AtRisk, Breached or Met.

workspaceIds
null | string<uuid>[]

The workspaces to read, at most 500; null or empty reads every workspace the caller may see. A service account sees the workspaces it holds a role on.

Response

OK

Standard v2 API response envelope for single-item responses.

data
object

One page of reporting facts for a drill-down table.

meta
object