Get incidents
curl --request GET \
--url https://api.petrasecurity.com/v1/incidents \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.petrasecurity.com/v1/incidents"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.petrasecurity.com/v1/incidents', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.petrasecurity.com/v1/incidents",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.petrasecurity.com/v1/incidents"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.petrasecurity.com/v1/incidents")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.petrasecurity.com/v1/incidents")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"incidents": [
{
"id": "a212087c-bc60-4fbc-8bf5-5a4c2f823e5f",
"url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/a212087c-bc60-4fbc-8bf5-5a4c2f823e5f",
"createdAt": "2026-01-20T12:33:15.000Z",
"occurredAt": "2026-01-20T12:28:47.000Z",
"remediationStatus": "REMEDIATED",
"isLive": true,
"dwellTimeMinutes": 4.483333333333333,
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": ""
},
"user": {
"id": "01be85ac-1cbd-47a4-bead-47fc8c2c65da",
"userPrincipalName": "asha.streich@acmecorp.com",
"mail": "asha.streich@acmecorp.com",
"displayName": "Asha Streich",
"accountEnabled": true,
"lastPasswordChangeDateTime": "2026-02-04T20:35:25.000Z"
},
"phishingEmail": {
"subject": "[EXTERNAL] Brad Smith shared \"ConEd LLC Due Pay Application\" with you",
"sender": {
"address": "brad.smith@conedaccting.com",
"displayName": "Brad Smith"
},
"from": {
"address": "brad.smith@conedaccting.com",
"displayName": "Brad Smith"
},
"internetMessageId": "<50khgaf2-qxez-35l9-jwmu-cbvqs8tvqibi@conedaccting.com>",
"sentAt": "2026-01-20T11:39:47.000Z",
"receivedAt": "2026-01-20T11:59:52.000Z",
"hasAttachments": false,
"sizeInBytes": null,
"originalLocation": "\\Inbox",
"currentLocation": "Hard Deleted",
"otherRecipients": [
"henry.braun@acmecorp.com",
"holly.connelly@acmecorp.com"
],
"similarPhishes": [
{
"internetMessageId": "<50khgaf2-qxez-35l9-jwmu-cbvqs8tvqibi@conedaccting.com>",
"recipientUpn": "henry.braun@acmecorp.com",
"matchType": "SAME_MESSAGE",
"currentLocation": "Hard Deleted"
},
{
"internetMessageId": "<50khgaf2-qxez-35l9-jwmu-cbvqs8tvqibi@conedaccting.com>",
"recipientUpn": "asha.streich@acmecorp.com",
"matchType": "SAME_MESSAGE",
"currentLocation": "Hard Deleted"
},
{
"internetMessageId": "<50khgaf2-qxez-35l9-jwmu-cbvqs8tvqibi@conedaccting.com>",
"recipientUpn": "holly.connelly@acmecorp.com",
"matchType": "SAME_MESSAGE",
"currentLocation": "Hard Deleted"
}
]
}
},
{
"id": "6f604112-3dbc-4c85-9a87-e451e58d0286",
"url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/6f604112-3dbc-4c85-9a87-e451e58d0286",
"createdAt": "2026-01-26T14:02:43.050Z",
"occurredAt": "2026-01-22T22:20:57.000Z",
"remediationStatus": "REMEDIATED",
"isLive": false,
"dwellTimeMinutes": 2902.766666666667,
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": ""
},
"user": {
"id": "0e50012e-ada7-42fa-bca2-754070f958a3",
"userPrincipalName": "nick.renner@acmecorp.com",
"mail": "nick.renner@acmecorp.com",
"displayName": "Nick Renner",
"accountEnabled": true,
"lastPasswordChangeDateTime": null
},
"phishingEmail": {
"subject": "Amended acme corp employee handbook",
"sender": {
"address": "admin@astoriahotel.ig",
"displayName": "Admin"
},
"from": {
"address": "admin@astoriahotel.ig",
"displayName": "Admin"
},
"internetMessageId": "<6cb64061-1df2-4cee-9bb2-1aacf7bb36d7@astoriahotel.ig>",
"sentAt": "2026-01-22T22:26:15.000Z",
"receivedAt": "2026-01-22T22:28:20.000Z",
"hasAttachments": false,
"sizeInBytes": null,
"originalLocation": "\\Inbox",
"currentLocation": "Hard Deleted",
"otherRecipients": [],
"similarPhishes": []
}
},
{
"id": "0776897d-be9d-4785-82b1-e240e64f2476",
"url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/0776897d-be9d-4785-82b1-e240e64f2476",
"createdAt": "2026-07-19T16:55:41.242Z",
"occurredAt": "2026-05-21T17:11:00.000Z",
"remediationStatus": "REMEDIATED_PRIOR_TO_ONBOARDING",
"isLive": false,
"dwellTimeMinutes": 60560.75,
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": ""
},
"user": {
"id": "bd4c7662-b0aa-4869-a57a-74ca66279e80",
"userPrincipalName": "fleta.rowe@acmecorp.com",
"mail": "fleta.rowe@acmecorp.com",
"displayName": "Fleta Rowe",
"accountEnabled": true,
"lastPasswordChangeDateTime": "2026-07-06T13:14:32.000Z"
},
"phishingEmail": null
},
{
"id": "3d71683e-5032-478a-b8c8-16c7e1073446",
"url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/3d71683e-5032-478a-b8c8-16c7e1073446",
"createdAt": "2026-07-09T07:22:19.480Z",
"occurredAt": "2026-06-02T23:26:52.000Z",
"remediationStatus": "REMEDIATED",
"isLive": false,
"dwellTimeMinutes": 63225.58333333334,
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": ""
},
"user": {
"id": "35e895d1-6d5d-4919-9a50-69383bc4558e",
"userPrincipalName": "misael.ledner@acmecorp.com",
"mail": "misael.ledner@acmecorp.com",
"displayName": "Misael Ledner",
"accountEnabled": true,
"lastPasswordChangeDateTime": "2026-07-16T16:27:46.000Z"
},
"phishingEmail": null
},
{
"id": "48f3708e-45c1-4902-9e3b-26165bf3d76a",
"url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/48f3708e-45c1-4902-9e3b-26165bf3d76a",
"createdAt": "2026-02-06T03:55:06.050Z",
"occurredAt": "2026-02-04T22:14:12.000Z",
"remediationStatus": "REMEDIATED",
"isLive": false,
"dwellTimeMinutes": 1918.650583333333,
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": ""
},
"user": {
"id": "2e8c5169-af3d-447b-9c4f-82d516b9fe34",
"userPrincipalName": "askywalker@acmecorp.com",
"mail": "askywalker@acmecorp.com",
"displayName": "Anakin Skywalker",
"accountEnabled": true,
"lastPasswordChangeDateTime": null
},
"phishingEmail": null
},
{
"id": "0c207800-80d0-46ed-beec-376779e33bbb",
"url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/0c207800-80d0-46ed-beec-376779e33bbb",
"createdAt": "2026-02-05T23:38:05.705Z",
"occurredAt": "2026-02-05T23:33:29.000Z",
"remediationStatus": "REMEDIATED",
"isLive": true,
"dwellTimeMinutes": 4.707216666666667,
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": ""
},
"user": {
"id": "7a3fd851-bc4e-489c-b6d2-35f940d7ace2",
"userPrincipalName": "ncaffrey@acmecorp.com",
"mail": "ncaffrey@acmecorp.com",
"displayName": "Neal Caffrey",
"accountEnabled": true,
"lastPasswordChangeDateTime": "2025-01-23T18:52:24.000Z"
},
"phishingEmail": null
}
]
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}Endpoints
Get Incidents
Retrieve security incidents ordered by creation date (newest first).
GET
/
v1
/
incidents
Get incidents
curl --request GET \
--url https://api.petrasecurity.com/v1/incidents \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.petrasecurity.com/v1/incidents"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.petrasecurity.com/v1/incidents', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.petrasecurity.com/v1/incidents",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.petrasecurity.com/v1/incidents"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.petrasecurity.com/v1/incidents")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.petrasecurity.com/v1/incidents")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"incidents": [
{
"id": "a212087c-bc60-4fbc-8bf5-5a4c2f823e5f",
"url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/a212087c-bc60-4fbc-8bf5-5a4c2f823e5f",
"createdAt": "2026-01-20T12:33:15.000Z",
"occurredAt": "2026-01-20T12:28:47.000Z",
"remediationStatus": "REMEDIATED",
"isLive": true,
"dwellTimeMinutes": 4.483333333333333,
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": ""
},
"user": {
"id": "01be85ac-1cbd-47a4-bead-47fc8c2c65da",
"userPrincipalName": "asha.streich@acmecorp.com",
"mail": "asha.streich@acmecorp.com",
"displayName": "Asha Streich",
"accountEnabled": true,
"lastPasswordChangeDateTime": "2026-02-04T20:35:25.000Z"
},
"phishingEmail": {
"subject": "[EXTERNAL] Brad Smith shared \"ConEd LLC Due Pay Application\" with you",
"sender": {
"address": "brad.smith@conedaccting.com",
"displayName": "Brad Smith"
},
"from": {
"address": "brad.smith@conedaccting.com",
"displayName": "Brad Smith"
},
"internetMessageId": "<50khgaf2-qxez-35l9-jwmu-cbvqs8tvqibi@conedaccting.com>",
"sentAt": "2026-01-20T11:39:47.000Z",
"receivedAt": "2026-01-20T11:59:52.000Z",
"hasAttachments": false,
"sizeInBytes": null,
"originalLocation": "\\Inbox",
"currentLocation": "Hard Deleted",
"otherRecipients": [
"henry.braun@acmecorp.com",
"holly.connelly@acmecorp.com"
],
"similarPhishes": [
{
"internetMessageId": "<50khgaf2-qxez-35l9-jwmu-cbvqs8tvqibi@conedaccting.com>",
"recipientUpn": "henry.braun@acmecorp.com",
"matchType": "SAME_MESSAGE",
"currentLocation": "Hard Deleted"
},
{
"internetMessageId": "<50khgaf2-qxez-35l9-jwmu-cbvqs8tvqibi@conedaccting.com>",
"recipientUpn": "asha.streich@acmecorp.com",
"matchType": "SAME_MESSAGE",
"currentLocation": "Hard Deleted"
},
{
"internetMessageId": "<50khgaf2-qxez-35l9-jwmu-cbvqs8tvqibi@conedaccting.com>",
"recipientUpn": "holly.connelly@acmecorp.com",
"matchType": "SAME_MESSAGE",
"currentLocation": "Hard Deleted"
}
]
}
},
{
"id": "6f604112-3dbc-4c85-9a87-e451e58d0286",
"url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/6f604112-3dbc-4c85-9a87-e451e58d0286",
"createdAt": "2026-01-26T14:02:43.050Z",
"occurredAt": "2026-01-22T22:20:57.000Z",
"remediationStatus": "REMEDIATED",
"isLive": false,
"dwellTimeMinutes": 2902.766666666667,
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": ""
},
"user": {
"id": "0e50012e-ada7-42fa-bca2-754070f958a3",
"userPrincipalName": "nick.renner@acmecorp.com",
"mail": "nick.renner@acmecorp.com",
"displayName": "Nick Renner",
"accountEnabled": true,
"lastPasswordChangeDateTime": null
},
"phishingEmail": {
"subject": "Amended acme corp employee handbook",
"sender": {
"address": "admin@astoriahotel.ig",
"displayName": "Admin"
},
"from": {
"address": "admin@astoriahotel.ig",
"displayName": "Admin"
},
"internetMessageId": "<6cb64061-1df2-4cee-9bb2-1aacf7bb36d7@astoriahotel.ig>",
"sentAt": "2026-01-22T22:26:15.000Z",
"receivedAt": "2026-01-22T22:28:20.000Z",
"hasAttachments": false,
"sizeInBytes": null,
"originalLocation": "\\Inbox",
"currentLocation": "Hard Deleted",
"otherRecipients": [],
"similarPhishes": []
}
},
{
"id": "0776897d-be9d-4785-82b1-e240e64f2476",
"url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/0776897d-be9d-4785-82b1-e240e64f2476",
"createdAt": "2026-07-19T16:55:41.242Z",
"occurredAt": "2026-05-21T17:11:00.000Z",
"remediationStatus": "REMEDIATED_PRIOR_TO_ONBOARDING",
"isLive": false,
"dwellTimeMinutes": 60560.75,
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": ""
},
"user": {
"id": "bd4c7662-b0aa-4869-a57a-74ca66279e80",
"userPrincipalName": "fleta.rowe@acmecorp.com",
"mail": "fleta.rowe@acmecorp.com",
"displayName": "Fleta Rowe",
"accountEnabled": true,
"lastPasswordChangeDateTime": "2026-07-06T13:14:32.000Z"
},
"phishingEmail": null
},
{
"id": "3d71683e-5032-478a-b8c8-16c7e1073446",
"url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/3d71683e-5032-478a-b8c8-16c7e1073446",
"createdAt": "2026-07-09T07:22:19.480Z",
"occurredAt": "2026-06-02T23:26:52.000Z",
"remediationStatus": "REMEDIATED",
"isLive": false,
"dwellTimeMinutes": 63225.58333333334,
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": ""
},
"user": {
"id": "35e895d1-6d5d-4919-9a50-69383bc4558e",
"userPrincipalName": "misael.ledner@acmecorp.com",
"mail": "misael.ledner@acmecorp.com",
"displayName": "Misael Ledner",
"accountEnabled": true,
"lastPasswordChangeDateTime": "2026-07-16T16:27:46.000Z"
},
"phishingEmail": null
},
{
"id": "48f3708e-45c1-4902-9e3b-26165bf3d76a",
"url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/48f3708e-45c1-4902-9e3b-26165bf3d76a",
"createdAt": "2026-02-06T03:55:06.050Z",
"occurredAt": "2026-02-04T22:14:12.000Z",
"remediationStatus": "REMEDIATED",
"isLive": false,
"dwellTimeMinutes": 1918.650583333333,
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": ""
},
"user": {
"id": "2e8c5169-af3d-447b-9c4f-82d516b9fe34",
"userPrincipalName": "askywalker@acmecorp.com",
"mail": "askywalker@acmecorp.com",
"displayName": "Anakin Skywalker",
"accountEnabled": true,
"lastPasswordChangeDateTime": null
},
"phishingEmail": null
},
{
"id": "0c207800-80d0-46ed-beec-376779e33bbb",
"url": "https://app.petrasecurity.com/tenant/ZZk90t/incidents/0c207800-80d0-46ed-beec-376779e33bbb",
"createdAt": "2026-02-05T23:38:05.705Z",
"occurredAt": "2026-02-05T23:33:29.000Z",
"remediationStatus": "REMEDIATED",
"isLive": true,
"dwellTimeMinutes": 4.707216666666667,
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": ""
},
"user": {
"id": "7a3fd851-bc4e-489c-b6d2-35f940d7ace2",
"userPrincipalName": "ncaffrey@acmecorp.com",
"mail": "ncaffrey@acmecorp.com",
"displayName": "Neal Caffrey",
"accountEnabled": true,
"lastPasswordChangeDateTime": "2025-01-23T18:52:24.000Z"
},
"phishingEmail": null
}
]
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}For common API errors, see API Troubleshooting.
This route is limited to 10 requests per minute.
Authorizations
Bearer token authentication. Include your API key in the Authorization header as 'Bearer YOUR_API_KEY'
Query Parameters
Filter incidents to a specific tenant. Accepts either a Petra tenant ID or a Microsoft tenant ID. You can find a tenant's Petra ID in the URL when viewing a tenant in the dashboard (e.g. app.petrasecurity.com/tenant/). You can also pass a Microsoft tenant ID and the endpoint will resolve it automatically.
Only return incidents created on or after this date. Accepts ISO 8601 format — either date only (e.g. 2026-03-01) or full date-time (e.g. 2026-03-05T00:53:10.402Z).
Maximum number of incidents to return. Defaults to 100, maximum 500.
Required range:
1 <= x <= 500Response
Successful response
Array of incident objects
Show child attributes
Show child attributes