> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Incidents

Get a list of Cyberhaven DLP incidents, with optional filters.

## Parameters

<div className="integrations-table">
  | Parameter            | Description                                                                                                                           |
  | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
  | Assignees            | A comma-separated list of assigned analyst emails to filter incidents by.                                                             |
  | End Time             | The end of the time range to filter incidents by. Only incidents before this time are returned.                                       |
  | Incident IDs         | A comma-separated list of incident IDs to filter by.                                                                                  |
  | Include AI Summaries | Select to include AI-generated incident summaries in the response.                                                                    |
  | Page ID              | The cursor from a previous response's `page_response.next_id`, used to fetch the next page. Leave empty to start from the first page. |
  | Page Size            | The maximum number of incidents to return per page. The API defaults to `25` and accepts up to `200`.                                 |
  | Policy Severities    | Select the policy severities to filter incidents by.                                                                                  |
  | Resolution Statuses  | Select the resolution statuses to filter incidents by.                                                                                |
  | Return All Pages     | Automatically fetch all resources, page by page.                                                                                      |
  | Sort By              | The field to sort incidents by. Defaults to `trigger_time`.                                                                           |
  | Start Time           | The start of the time range to filter incidents by. Only incidents at or after this time are returned.                                |
  | Users                | A comma-separated list of user emails or aliases to filter incidents by, based on who triggered the incident.                         |
</div>

## Example Output

```json theme={"dark"}
{
	"resources": [
		{
			"id": "string",
			"status": "open",
			"blocked": true,
			"trigger_time": "2024-01-01T00:00:00Z",
			"event_time": "2024-01-01T00:00:00Z",
			"reaction_time": "2024-01-01T00:00:00Z",
			"ai_summary": "string",
			"ai_severity": "high",
			"risk_score": 0,
			"created_by": "policy",
			"assigned_to": "string",
			"close_reason": "",
			"close_note": "",
			"warning_status": "not_applicable",
			"user": {
				"id": "string",
				"local_id": "string",
				"email": "string"
			},
			"policy": {
				"id": "string",
				"name": "string",
				"severity": "high"
			},
			"dataset": {
				"id": "string",
				"name": "string"
			},
			"event_details": {
				"start_event": {
					"id": "string",
					"timestamp": "2024-01-01T00:00:00Z",
					"action": {
						"kind": "dlp_scan"
					}
				},
				"end_event": {
					"id": "string",
					"timestamp": "2024-01-01T00:00:00Z",
					"action": {
						"kind": "dar_scan"
					}
				}
			},
			"event_lineage_id": {
				"start_event_id": "string",
				"end_event_id": "string"
			}
		}
	],
	"page_response": {
		"next_id": "string",
		"total": 0
	}
}
```

## Workflow Library Example

[List Incidents with Cyberhaven and Send Results Via Email](https://library.blinkops.com/workflows/list-incidents-with-cyberhaven-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/list-incidents-with-cyberhaven-and-send-results-via-email/canvas" />
</div>