Who is this for? Security engineers and analysts who build dashboards in Power BI, Excel or another BI tool from ContraForce reporting.
Prerequisites
- A service account with a credential that carries
incidents:read. - A role for the service account on each workspace you want to report on. Keep a list of those workspace IDs: the service account reads only the workspaces it holds a role on.
How it works
Ask for a range longer than 92 days and every trend comes back with one point per month. One call to each of two endpoints per workspace then covers up to a year:POST /reporting/incident-flow: incidents received, closed (and who closed them) and investigated, and the median time to close.POST /reporting/agent-investigations: agent runs and how they ended.
workspaceIds to get that workspace’s figures on their own.
Example
This Python script pulls January to October 2026 for each workspace and writesreporting-summary.csv. It reads the credential from the CONTRAFORCE_CLIENT_ID and CONTRAFORCE_CLIENT_SECRET environment variables.
month is yyyy-MM, a UTC calendar month.
Things to know
receivedcounts incidents detected in the month andclosedcounts closures in the month, so an incident detected in March and closed in April counts once in each.medianTimeToCloseSecondsisnullfor a month with no closures whose detection time is known.- Each workspace takes two calls. The rate limit is 120 reporting calls a minute per service account, so pace the calls when you report on more than 60 workspaces, rather than relying on the wait after a
429. - Service accounts get the activity counts, not the spend: cost fields come back
null. - For the incidents behind a figure, such as every incident escalated in March, read the records with
/reporting/factsor export them with/reporting/facts/export.
Related guides
Reporting Endpoints
Every reporting endpoint, its limits, the record types and the rate limits.
Reporting Object Models
Example requests and responses, and the keys each breakdown uses.
Service Accounts
Create a service account and issue the credential this guide uses.
Error Reference
What each error code means and how to act on it.
Need help? Contact support@contraforce.com.