Skip to content
adversarial

Get aggregated incident metrics for an organization.

GET
/v1/organizations/{id}/incident-metrics
curl --request GET \
  --url 'https://api.adversarial.com/api/v1/organizations/123e4567-e89b-12d3-a456-426614174000/incident-metrics?start_date=2026-01-01&end_date=2026-12-31'

Summarizes the organization’s incidents over a recent time window: open and contained counts, a breakdown by severity, the mean time to respond (MTTR) along with its change from the preceding window, and the daily backlog trend.

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

The UUID of the organization

Example
123e4567-e89b-12d3-a456-426614174000

Query Parameters

Section titled “Query Parameters”
start_date
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive start of the window. A bare YYYY-MM-DD starts it at 00:00:00Z of that day; an RFC 3339 timestamp in any UTC offset is used as given. Defaults to the start of the day 90 days before today, in end_date’s offset (UTC when neither bound is given).

Example
2026-01-01
end_date
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive end of the window. A bare YYYY-MM-DD ends it at 23:59:59.999999Z of that day; an RFC 3339 timestamp in any UTC offset is used as given. Defaults to the end of today, in start_date’s offset (UTC when neither bound is given).

Example
2026-12-31
severity
Array | null

Severity bands to include. Repeat the parameter to include several, e.g. ?severity=SEV-1&severity=SEV-2. Accepts the severity levels plus the literal null for incidents that have not been scored. Omit to include every band.

Responses

Section titled “Responses”

200

Section titled “200”

Aggregated incident metrics for the organization

Media typeapplication/json

Organization incident metrics for dashboard and portfolio summaries.

object
bySeverity
required

Incidents DETECTED in the window, bucketed by severity. Fixed order [SEV-1, SEV-2, SEV-3, SEV-4, SEV-5, Unscored]; index 5 holds incidents with no severity score.

Array<integer>
containedCount
required

Incidents contained within the window (by contained_date).

integer format: int64
mttrDeltaMin

Signed change in MTTR (minutes) vs the immediately preceding window of the same length: current − previous. None if either window has no responded incidents (no baseline).

number | null format: double
mttrMin

Mean time to respond: average MINUTES from detected_date to responded_date across window incidents that have responded (response, not containment/resolution). None when none have responded; clock-skew negative durations are dropped.

number | null format: double
openCount
required

Incidents DETECTED within the window, whatever their status now — scoped to the window like contained_count. Equals the sum of by_severity.

integer format: int64
orgId
required

Organization the metrics are scoped to.

string format: uuid
periodDays
required

Span of the requested [start_date, end_date] window in whole days, measured over each incident’s detected date. Echoed back so the client can confirm the bounds it was served.

integer format: int32
trend
required

Daily backlog trend over the window.

object
current
required

Backlog total at the newest point.

integer format: int64
deltaPct

Relative change (current − previous) / previous; None when previous is 0.

number | null format: double
peak
required

Largest daily backlog total over the window.

integer format: int64
points
required

One point per calendar day the window spans, oldest→newest — both ends inclusive, so a period_days-wide window yields period_days + 1 points and the newest is dated end_date. Each point is the standing open backlog at that day’s end (detected on/before it and not yet contained), not that day’s inflow.

Array<object>

One daily point in the incident backlog trend.

object
date
required

The day this point ends on, YYYY-MM-DD (the day’s closing boundary).

string
sev
required

Backlog by severity at the day’s end. Order [SEV-1, SEV-2, SEV-3, SEV-4, SEV-5, Unscored] (index 5 = unscored).

Array<integer>
total
required

Total backlog at the day’s end (sev.iter().sum()).

integer format: int64
previous
required

Backlog total at the oldest point (the delta baseline).

integer format: int64
Examplegenerated
{
  "bySeverity": [
    1
  ],
  "containedCount": 1,
  "mttrDeltaMin": 1,
  "mttrMin": 1,
  "openCount": 1,
  "orgId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "periodDays": 1,
  "trend": {
    "current": 1,
    "deltaPct": 1,
    "peak": 1,
    "points": [
      {
        "date": "example",
        "sev": [
          1
        ],
        "total": 1
      }
    ],
    "previous": 1
  }
}

404

Section titled “404”

Organization not found