Get aggregated incident metrics for an organization.
const url = 'https://api.adversarial.com/api/v1/organizations/123e4567-e89b-12d3-a456-426614174000/incident-metrics?start_date=2026-01-01&end_date=2026-12-31';const options = {method: 'GET'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://api.adversarial.com/api/v1/organizations/123e4567-e89b-12d3-a456-426614174000/incident-metrics?start_date=2026-01-01&end_date=2026-12-31'Summarizes the organization’s incidents over a recent time window: open and contained counts, a breakdown by severity, the mean time to respond (MTTR) along with its change from the preceding window, and the daily backlog trend.
Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”The UUID of the organization
Example
123e4567-e89b-12d3-a456-426614174000Query Parameters
Section titled “Query Parameters”Inclusive lower bound on the window. RFC 3339 timestamp or bare
YYYY-MM-DD; either way the window starts at 00:00:00Z of the UTC day
it falls on. Defaults to 90 days before today.
Example
2026-01-01Inclusive upper bound on the window. RFC 3339 timestamp or bare
YYYY-MM-DD; either way the window ends at 23:59:59.999999Z of the UTC
day it falls on. Defaults to end-of-day today.
Example
2026-12-31Severity bands to include. Repeat the parameter to include several, e.g.
?severity=SEV-1&severity=SEV-2. Accepts the severity levels plus the
literal null for incidents that have not been scored. Omit to include
every band.
Responses
Section titled “Responses”Aggregated incident metrics for the organization
Organization incident metrics for dashboard and portfolio summaries.
object
Incidents DETECTED in the window, bucketed by severity. Fixed order
[SEV-1, SEV-2, SEV-3, SEV-4, SEV-5, Unscored]; index 5 holds incidents
with no severity score.
Incidents contained within the window (by contained_date).
Signed change in MTTR (minutes) vs the immediately preceding window of
the same length: current − previous. None if either window has no
responded incidents (no baseline).
Mean time to respond: average MINUTES from detected_date to
responded_date across window incidents that have responded (response,
not containment/resolution). None when none have responded;
clock-skew negative durations are dropped.
Incidents DETECTED within the window, whatever their status now —
scoped to the window like contained_count. Equals the sum of
by_severity.
Organization the metrics are scoped to.
Span of the requested [start_date, end_date] window in whole days,
measured over each incident’s detected date. Echoed back so the client
can confirm the bounds it was served.
Daily backlog trend over the window.
object
Backlog total at the newest point.
Relative change (current − previous) / previous; None when previous
is 0.
Largest daily backlog total over the window.
One point per calendar day the window spans, oldest→newest — both ends
inclusive, so a period_days-wide window yields period_days + 1
points and the newest is dated end_date. Each point is the standing
open backlog at that day’s end (detected on/before it and not yet
contained), not that day’s inflow.
One daily point in the incident backlog trend.
object
The day this point ends on, YYYY-MM-DD (the day’s closing boundary).
Backlog by severity at the day’s end. Order
[SEV-1, SEV-2, SEV-3, SEV-4, SEV-5, Unscored] (index 5 = unscored).
Total backlog at the day’s end (sev.iter().sum()).
Backlog total at the oldest point (the delta baseline).
Examplegenerated
{ "bySeverity": [ 1 ], "containedCount": 1, "mttrDeltaMin": 1, "mttrMin": 1, "openCount": 1, "orgId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "periodDays": 1, "trend": { "current": 1, "deltaPct": 1, "peak": 1, "points": [ { "date": "example", "sev": [ 1 ], "total": 1 } ], "previous": 1 }}Organization not found