> This page is for Applications Protection. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.humansecurity.com/llms.txt. # Get incidents GET https://api-gw.perimeterx.com/v1/incidents Get a list of detected incidents for the given Application IDs and host domains. Reference: https://docs.humansecurity.com/applications/reference/get-incidents ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer `, where token is your auth token. ## Request ### Query parameters - `appId` (list of string, required) — An array of Application IDs to filter the relevant incidents by. At least one ID is required. - `tld` (list of string, required) — An array of host domains to filter the relevant incidents by. At least one domain is required. - `from` (integer, optional) — A timestamp, in milliseconds, indicating from what point in time to filter the results by. Defaults to the past 24 hours. - `to` (integer, optional) — A timestamp, in milliseconds, indicating until what point in time to filter the results by. Defaults to the current time. - `skip` (integer, optional, default: 0) — The number of incidents to offset pagination by when returning the results. - `take` (integer, optional, default: 20) — The number of incidents to display per page when returning the results. ## Response ### 200 Success - `paging` (GetIncidentsPaging, optional) - `data` (list of GetIncidentsDataItems, optional) ## Errors ### 401 Unauthorized Error Access token is missing or invalid. - `any` ### 422 Unprocessable Entity Error Invalid or missing parameters. - `any` ### 500 Internal Server Error Internal error. Contact HUMAN if the error persists. - `any` ## Types ### GetIncidentsPaging - `previous` (string, optional) - `current` (string, optional) - `next` (string, optional) - `count` (integer, optional) ### GetIncidentsDataItems - `id` (string, optional) — The ID of the incident. - `category` (string, optional) - `incident` (string, optional) - `details` (string, optional) - `initiator` (string, optional) - `first_seen` (string, optional) - `last_seen` (string, optional) - `host_domain` (string, optional) - `app_id` (string, optional) - `page_types` (list of string, optional) - `page_types_per` (GetIncidentsDataItemsPageTypesPer, optional) - `ack_updated_at` (string, optional) - `additional_data` (GetIncidentsDataItemsAdditionalData, optional) - `under_review` (boolean, optional) - `risk_level` (string, optional) - `script` (GetIncidentsDataItemsScript, optional) - `actions` (list of GetIncidentsDataItemsActionsItems, optional) ### GetIncidentsDataItemsPageTypesPer - `checkout` (float, optional) - `login` (float, optional) - `products_and_search` (float, optional) ### GetIncidentsDataItemsAdditionalData - `vulnerabilities` (list of GetIncidentsDataItemsAdditionalDataVulnerabilitiesItems, optional) ### GetIncidentsDataItemsScript - `users_affected_percentage` (float, optional) - `ack` (boolean, optional) - `key` (string, optional) - `id` (string, optional) - `app_id` (string, optional) - `host_domain` (string, optional) - `type` (string, optional) - `vendor` (string, optional) - `first_seen` (string, optional) - `last_seen` (string, optional) - `risk` (GetIncidentsDataItemsScriptRisk, optional) - `page_types` (list of string, optional) ### GetIncidentsDataItemsActionsItems - `type` (string, optional) - `subtype` (string, optional) - `last_seen` (string, optional) - `action_args` (GetIncidentsDataItemsActionsItemsActionArgs, optional) ### GetIncidentsDataItemsAdditionalDataVulnerabilitiesItems - `package` (string, optional) - `version` (string, optional) - `ids` (list of string, optional) ### GetIncidentsDataItemsScriptRisk - `level` (string, optional) - `reason` (string, optional) ### GetIncidentsDataItemsActionsItemsActionArgs - `Storage Key` (string, optional) - `Element ID` (string, optional) - `Element Name` (string, optional) - `Element tags` (string, optional) - `Target URL Host` (string, optional) - `Inserted Element Tag` (string, optional) - `Removed Element Tag` (string, optional) ## Examples **Response** ```json { "paging": { "previous": "", "current": "https://10.192.0.80:80/v1/incidents?appId=ABC123&tld=example.com&take=20&skip=0", "next": "https://10.192.0.80:80/v1/incidents?appId=ABC123&tld=example.com&take=20&skip=20", "count": 1000 }, "data": [ { "id": "507f1f77bcf86cd799439011", "category": "pii", "incident": "Credentials - Email access is being made by a third party script", "details": "Accessing email address.", "initiator": "script.com/lib/main.[UNIQUE_ID].js", "first_seen": "2022-01-30T12:15:49Z", "last_seen": "2023-03-23T08:55:27Z", "host_domain": "example.com", "app_id": "PXabc123", "page_types": [ "checkout", "products_and_search" ], "page_types_per": { "checkout": 1.436782, "login": 1.060606, "products_and_search": 0.015879 }, "ack_updated_at": "2022-04-26T08:54:22.084Z", "additional_data": { "vulnerabilities": [ { "package": "jquery-ui", "version": "1.0.0", "ids": [ "CVE-2022-1234", "CVE-2022-5678" ] } ] }, "under_review": true, "risk_level": "high", "script": { "users_affected_percentage": 50.5, "ack": false, "key": "11aa22bbcc3344ddeeff5566gghh", "id": "script/lib/main.[UNIQUE_ID].js", "app_id": "PXabc123", "host_domain": "example.com", "type": "third_party", "vendor": "Google", "first_seen": "2021-12-30T16:18:53Z", "last_seen": "2023-03-23T09:13:44Z", "risk": { "level": "medium", "reason": "PII sniffing" }, "page_types": [ "checkout", "login", "products_and_search" ] }, "actions": [ { "type": "DOM Removal", "subtype": "Deleted script", "last_seen": "2023-03-23T09:13:44Z", "action_args": { "Storage Key": "mixPanel", "Element ID": "email", "Element Name": "email", "Element tags": "script", "Target URL Host": "juggler", "Inserted Element Tag": "script", "Removed Element Tag": "" } } ] } ] } ``` **SDK Code** ```python import requests url = "https://api-gw.perimeterx.com/v1/incidents" querystring = {"appId":"[\"abc123\",\"def456\"]","from":"1674313200000","skip":"40","take":"10","tld":"[\"domain1.com\",\"domain2.com\"]","to":"1674313200000"} headers = {"Authorization": "Bearer "} response = requests.get(url, headers=headers, params=querystring) print(response.json()) ``` ```javascript const url = 'https://api-gw.perimeterx.com/v1/incidents?appId=%5B%22abc123%22%2C%22def456%22%5D&from=1674313200000&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "net/http" "io" ) func main() { url := "https://api-gw.perimeterx.com/v1/incidents?appId=%5B%22abc123%22%2C%22def456%22%5D&from=1674313200000&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://api-gw.perimeterx.com/v1/incidents?appId=%5B%22abc123%22%2C%22def456%22%5D&from=1674313200000&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["Authorization"] = 'Bearer ' response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("https://api-gw.perimeterx.com/v1/incidents?appId=%5B%22abc123%22%2C%22def456%22%5D&from=1674313200000&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000") .header("Authorization", "Bearer ") .asString(); ``` ```php request('GET', 'https://api-gw.perimeterx.com/v1/incidents?appId=%5B%22abc123%22%2C%22def456%22%5D&from=1674313200000&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000', [ 'headers' => [ 'Authorization' => 'Bearer ', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://api-gw.perimeterx.com/v1/incidents?appId=%5B%22abc123%22%2C%22def456%22%5D&from=1674313200000&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000"); var request = new RestRequest(Method.GET); request.AddHeader("Authorization", "Bearer "); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = ["Authorization": "Bearer "] let request = NSMutableURLRequest(url: NSURL(string: "https://api-gw.perimeterx.com/v1/incidents?appId=%5B%22abc123%22%2C%22def456%22%5D&from=1674313200000&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```