Export incidents as CSV

POST

/v1/incidents/export

• Production
• Staging
• Local

Request Body

One of:

null

null

object

object

columns

Optional list of column keys to include, in order. If None, exports all columns.

array | null

Allowed values: id title description status severity source created_date updated_date detected_date occurred_date responded_date contained_date assigned_to opened_by severity_reasoning tags

filename

Optional custom filename (without .csv extension)

string | null

filter

One of:

null

null

object

Filter applied in “All in filter” mode. Used when selected_incidents is empty. Pagination on the filter is overridden by streaming defaults.

object

assigned_to

Accepts UUIDs, the literal null (unassigned), and the sentinel me (the calling user, resolved server-side). Multiple values union.

array | null

unique items

contained_after

Inclusive lower bound on contained_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

contained_before

Inclusive upper bound on contained_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

contained_is_null

Match only incidents whose contained_date is unset. Mutually exclusive with contained_after/contained_before.

boolean | null

created_after

Inclusive lower bound on created_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

created_before

Inclusive upper bound on created_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

description_contains

string | null

detected_after

Inclusive lower bound on detected_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

detected_before

Inclusive upper bound on detected_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

free_text

string | null

id

array | null

id_contains

string | null

include_children

When true, the list includes incidents that are linked under another incident (i.e. rows with a non-null parent_id). Defaults to false so registers and rollups stay collapsed.

boolean | null

occurred_after

Inclusive lower bound on occurred_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

occurred_before

Inclusive upper bound on occurred_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

occurred_is_null

Match only incidents whose occurred_date is unset. Mutually exclusive with occurred_after/occurred_before.

boolean | null

opened_by

array | null

unique items

order_by

string | null

page

1-indexed page number. Defaults to 1 (explicit null reads as the default); zero is rejected.

integer format: int64

default: 1 >= 1 <= 1000000

page_size

Rows per page. Defaults to 50 (explicit null reads as the default); zero is rejected.

integer format: int64

default: 50 >= 1 <= 500

responded_after

Inclusive lower bound on responded_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

responded_before

Inclusive upper bound on responded_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

responded_is_null

Match only incidents whose responded_date is unset. Mutually exclusive with responded_after/responded_before.

boolean | null

severity

array | null

unique items

source

array | null

unique items

status

array | null

unique items

Allowed values: New In Progress Review Closed

tags

array | null

unique items

threat_objectives

array | null

unique items

title_contains

string | null

updated_after

Inclusive lower bound on updated_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

updated_before

Inclusive upper bound on updated_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

updated_by

array | null

unique items

selected_incidents

required

IDs of selected rows. When non-empty, exports only these and ignores filter. When empty, falls back to “All in filter”.

Array<string>

Example

INC-00001

Responses

200

Export all incidents with current state as CSV

Array<integer>