> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.
# List Incidents
Responses are paginated, and clients with a large number of incidents may need to submit multiple requests to obtain the entire datasetSample requestsBasic Search - no filtering: GET /api/external/incident/searchPassing page size and page number: GET /api/external/incident/search?PageNumber=2\&PageSize=10Passing date and time: GET /api/external/incident/search?CreatedDateFrom=2021-05-30T14:59:15.449Z\&CreatedDateTo=2021-06-30T14:59:15.449ZPassing Brand names - BrandName requires to be Encoded. e.g. Brother's -> Brother%27s: GET /api/external/incident/search?BrandNames=Brother%27sPassing arrays: GET /api/external/incident/search?BrandNames=Brother-1\&BrandNames=Brother-2.
External Documentation
To learn more, visit the [PhishLabs documentation](https://threatintel.phishlabs.com/swagger/index.html).
## Basic Parameters
| Parameter | Description |
| ---------- | ------------------------------------------------------------------ |
| Sort Field | Contains a list of filter fields that can participate in order by. |
| Sort Order | Represents available sort types. |
## Advanced Parameters
| Parameter | Description |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Brand Names | The Brands of incidents to be returned.
This list is unique to your organization.
See existing incidents in the Web App for examples, or contact your PhishLabs representative for a comprehensive list. |
| Created Date From | The minimum date and time that incidents were created.
Format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SS.SSS+HH:MM (ISO). |
| Created Date To | The maximum date and time that incidents were created.
Format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SS.SSS+HH:MM (ISO). |
| Incident Severity Codes | The severity of incidents to be returned. |
| Incident Status Codes | The statuses of incidents to be returned. |
| Incident Status Reason Codes | The Status Reasons of Closed or Persistent Threat incidents to be returned. |
| Incident Type Code | An incident type code. |
| Last Modified Date From | The minimum date and time that incidents were modified.
Format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SS.SSS+HH:MM (ISO). |
| Last Modified Date To | The maximum date and time that incidents were modified.
Format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SS.SSS+HH:MM (ISO). |
| Page Number | The page you want to fetch.
Default: 1. |
| Page Size | The number of items to be returned on a single page.
Default: 100.
Max: 200. |
| Threat Type Codes | The type of Threats to be returned.
Threat Types ending with "SM" are Social Media, "DW" are Dark Web. |
## Example Output
```json theme={"dark"}
{
"items": [
{
"brandName": "A Brand name.",
"changeLogs": [
{
"content": "A content of the record.",
"createdBy": "Who created this record.",
"timeStamp": "A created date of the record."
}
],
"created": "An incident created date.",
"createdBy": "Who created this incident.",
"executiveName": "A name of executive.",
"id": 0,
"incidentType": "A type of the incident.",
"lastModified": "Last modified date.",
"observables": [
{
"id": 0,
"type": "A type of the Observable.",
"url": "A URL of the Post, Social profile or Event."
}
],
"severity": "An incident severity.",
"status": "A status of the incident.",
"statusReason": "A reason of the incident status, if available.",
"summary": "An incident summary.",
"threatType": "A threat type.",
"title": "A title of the incident."
}
],
"pageNumber": 0,
"pageSize": 0,
"pagesCount": 0,
"totalCount": 0
}
```
## Workflow Library Example
[List Incidents with Phishlabs and Send Results Via Email](https://library.blinkops.com/workflows/list-incidents-with-phishlabs-and-send-results-via-email)
Preview this Workflow on desktop