> ## Documentation Index > Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt > Use this file to discover all available pages before exploring further. # List Incidents List and filter incidents created within a specified time range. **Note**: The response includes a `nextStartTime` value. To retrieve incidents beyond the `Limit`, run this action again using that value as the `Start Time`. External Documentation To learn more, visit the [Skyhigh Security documentation](https://success.skyhighsecurity.com/Skyhigh_SSE_APIs/Incidents_API/02_Incidents_API_Paths#Retrieves_Incidents). ## Basic Parameters
| Parameter | Description | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Actor IDs | A comma-separated list of user identifiers to filter incidents by. | | Categories | A JSON array of incident categories to filter by. See the [Incident Criteria documentation](https://success.skyhighsecurity.com/Skyhigh_SSE_APIs/Incidents_API/Incidents_API_Definitions#_incidentcriteria) for the full schema.

**For example:**
\[
  \{ 
    "incidentType": "Threat" 
  },
  \{ 
    "incidentType": "Alert", 
    "category": "Policy" 
  }
]
| | End Time | The end of the time range to retrieve incidents from. | | Fields | A JSON object of fields to filter by

**For example:**
\{
    "policyName": \["PII", "Encrypted files"]
  }
| | Historical User Risk Score | Select the historical user risk score to filter sanctioned DLP incidents by. | | Limit | The maximum number of incidents to return.

Values can range from `1` to `500`. | | Product | Select the product type to filter incidents by. | | Service Names | A comma-separated list of cloud service names to filter incidents by. | | Start Time | The beginning of the time range to retrieve incidents from. |
## Advanced Parameters
| Parameter | Description | | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Additional Parameters | A JSON object for additional body parameters. Values specified in this parameter will override equivalent parameters.

For example:
\{
    "first\_key": 12345,
    "second\_key": "some\_value"
}
The object must follow the vendor's structure as defined in the [API documentation](https://success.skyhighsecurity.com/Skyhigh_SSE_APIs/Incidents_API/02_Incidents_API_Paths#Retrieves_Incidents). |
## Example Output ```json theme={"dark"} { "incidents": [ { "activityNames": [], "actorId": "test_mitre_robot_0_1598664766_87@shn.com", "actorIdType": "USER", "incidentGroup": "Threat.Compromised Accounts.Land Expand Exfiltrate", "incidentGroupId": null, "incidentId": "THR-51938", "incidentRiskScore": 10.0, "incidentRiskSeverity": "high", "information": { "anomalyCount": 4, "anomalyIds": "", "category": "Compromised Accounts", "device": { "ip": "0.0.0.0" }, "mitreTactic": [ "Persistence", "Exfiltration", "Initial Access", "Collection" ], "mitreTechnique": [ "Email Collection", "Share Data from Cloud Account", "Valid Accounts", "Account Manipulation" ], "userAttributes": {} }, "instanceId": null, "instanceName": null, "responses": [], "serviceNames": [ "Office365", "Office365", "OneDrive", "Office365", "AzureAD", "Exchange Online" ], "significantlyUpdatedAt": "2020-09-12T23:43:49.314Z", "status": "opened", "timeCreated": "2020-09-12T23:39:48.824Z", "timeModified": "2020-09-12T23:43:49.314Z" } ], "responseInfo": { "nextStartTime": "2020-09-12T23:43:49.314Z" } } ``` ## Workflow Library Example [List Incidents with Skyhigh Security and Send Results Via Email](https://library.blinkops.com/workflows/list-incidents-with-skyhigh-security-and-send-results-via-email)
Workflow Library Preview this Workflow on desktop