Skip to main content
The reporting endpoints return the same totals and trends as the portal’s reporting page. This guide pulls a month-by-month summary for each workspace, one row per workspace and month, ready to load into a BI tool.
Who is this for? Security engineers and analysts who build dashboards in Power BI, Excel or another BI tool from ContraForce reporting.

Prerequisites

  • A service account with a credential that carries incidents:read.
  • A role for the service account on each workspace you want to report on. Keep a list of those workspace IDs: the service account reads only the workspaces it holds a role on.

How it works

Ask for a range longer than 92 days and every trend comes back with one point per month. One call to each of two endpoints per workspace then covers up to a year:
  • POST /reporting/incident-flow: incidents received, closed (and who closed them) and investigated, and the median time to close.
  • POST /reporting/agent-investigations: agent runs and how they ended.
Name one workspace in workspaceIds to get that workspace’s figures on their own.

Example

This Python script pulls January to October 2026 for each workspace and writes reporting-summary.csv. It reads the credential from the CONTRAFORCE_CLIENT_ID and CONTRAFORCE_CLIENT_SECRET environment variables.
Each row’s month is yyyy-MM, a UTC calendar month.

Things to know

  • received counts incidents detected in the month and closed counts closures in the month, so an incident detected in March and closed in April counts once in each.
  • medianTimeToCloseSeconds is null for a month with no closures whose detection time is known.
  • Each workspace takes two calls. The rate limit is 120 reporting calls a minute per service account, so pace the calls when you report on more than 60 workspaces, rather than relying on the wait after a 429.
  • Service accounts get the activity counts, not the spend: cost fields come back null.
  • For the incidents behind a figure, such as every incident escalated in March, read the records with /reporting/facts or export them with /reporting/facts/export.

Reporting Endpoints

Every reporting endpoint, its limits, the record types and the rate limits.

Reporting Object Models

Example requests and responses, and the keys each breakdown uses.

Service Accounts

Create a service account and issue the credential this guide uses.

Error Reference

What each error code means and how to act on it.
Need help? Contact support@contraforce.com.
Last modified on November 9, 2026