Skip to main content
Retrieve a list of escalations requiring administrator attention, such as false positive reports, threat clarifications, and VPN logins.
External DocumentationTo learn more, visit the Huntress documentation.

​
Parameters

ParameterDescription
LimitThe maximum number of results to return per page. Defaults to 10, with a minimum of 1 and a maximum of 500.
Organization IDThe ID of the organization to filter the results by.
Page TokenThe token used to retrieve the next page of results.
Return All PagesAutomatically fetch all resources, page by page.
SeveritySelect the severity to filter the results by.
Sort DirectionSelect the sort direction for the results.
Sort FieldSelect the field to sort the results by.
StatusSelect the status to filter the escalations by.
SubtypeThe escalation subtype to filter the results by.

​
Example Output

{
	"escalations": [
		{
			"id": 84938,
			"account": {
				"id": 1,
				"name": "Your Account Name"
			},
			"organizations": [
				{
					"id": 1234,
					"name": "ExampleCo"
				}
			],
			"created_at": "2025-09-05T18:20:34Z",
			"resolved_at": "2025-09-05T18:20:34Z",
			"severity": "low",
			"status": "resolved",
			"subject": "Defender Disabled",
			"subtype": "US",
			"type": "Environmental Issue",
			"updated_at": "2025-09-05T18:20:34Z"
		}
	],
	"pagination": {
		"next_page_url": "string",
		"next_page_token": "string"
	}
}

​
Workflow Library Example

List Escalations with Huntress and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop