> ## Documentation Index > Fetch the complete documentation index at: https://docs.coralogix.com/llms.txt > Use this file to discover all available pages before exploring further. # Get incident aggregations > Retrieve aggregated incident data with support for grouping and filtering. Requires the following permissions: - `incidents:read` ## OpenAPI ````yaml openapi_v5.yaml get /incidents/aggregations/v1 openapi: 3.0.0 info: title: '' version: 1.0.0 servers: - url: https://api.coralogix.com/mgmt/openapi/5 - url: https://api.eu2.coralogix.com/mgmt/openapi/5 - url: https://api.coralogix.us/mgmt/openapi/5 - url: https://api.cx498.coralogix.com/mgmt/openapi/5 - url: https://api.coralogix.in/mgmt/openapi/5 - url: https://api.coralogixsg.com/mgmt/openapi/5 - url: https://api.ap3.coralogix.com/mgmt/openapi/5 security: - apiKeyAuth: [] tags: - name: AI Applications Service description: Manage the catalog of AI applications discovered from spans. externalDocs: url: '' - name: AI Evaluations Service description: >- Manage AI evaluations and the custom evaluation catalog for AI applications. externalDocs: url: '' - name: API Keys Admin Service description: Administrative operations for API Keys management. externalDocs: url: '' - name: API Keys Service description: Manage your API Keys. externalDocs: url: '' - name: Actions Service description: View and manage your Actions. externalDocs: url: '' - name: Alert Scheduler Rule service description: Manage your alert scheduler rules. externalDocs: url: '' - name: Alert definitions service description: >- View and manage your alerts using alert definitions - data structures that contain the configuration required to create an alert. externalDocs: description: Learn more about alerts in our documentation url: https://coralogix.com/docs/user-guides/alerting/introduction-to-alerts/ - name: Alert events service description: >- Get information regarding your alert events - instances of alerts being triggered. externalDocs: description: Learn more about alert events and incidents in our documentation. url: https://coralogix.com/docs/user-guides/alerting/incidents/ - name: Case Events service description: Manage case events, comments, and external thread synchronization. externalDocs: url: '' - name: Case Settings service description: Manage case settings team configurations. externalDocs: url: '' - name: Cases notification service description: Track notification adjacent data for cases. externalDocs: url: '' - name: Cases service description: >- Manage cases throughout their lifecycle. Create, view, assign, acknowledge, unacknowledge, resolve, and close cases to streamline investigations and follow-ups. externalDocs: description: Learn more about Cases in our documentation url: https://coralogix.com/docs/user-guides/cases/ - name: Connector Schema service description: Retrieve connector schemas for notification center integrations externalDocs: description: Learn more about connectors in our documentation url: >- https://coralogix.com/docs/user-guides/notification-center/connectors/introduction/ - name: Connectors service description: >- View and manage your connectors - integration instances for notification destinations externalDocs: description: Lean more about connectors in our documentation url: >- https://coralogix.com/docs/user-guides/notification-center/connectors/introduction/ - name: Contextual data integration service description: Query for contextual data integration information. externalDocs: url: '' - name: Custom Enrichments Service description: Manage your enrichments. externalDocs: url: '' - name: Dashboard folders service description: Manage your dashboard folders. externalDocs: url: '' - name: Dashboard service description: Get information about the Coralogix Dashboard catalog. externalDocs: url: '' - name: Data Usage Query service description: >- Query billable data usage through the public Coralogix API using daily or hourly bucketed aggregations over supported labels. externalDocs: url: '' - name: Data Usage Service description: A service to manage data usage metrics. externalDocs: url: '' - name: Enrichments Service description: Manage your enrichments. externalDocs: url: '' - name: Entities service description: Query information about registered entities in the notification center externalDocs: description: Lean more about the notification center in our documentation url: https://coralogix.com/docs/user-guides/notification-center/introduction/ - name: Events Service description: A service for querying events. externalDocs: description: Learn more about alerts in our documentation url: https://coralogix.com/docs/user-guides/alerting/introduction-to-alerts/ - name: Events2Metrics Service description: Manage your events2metrics. externalDocs: url: '' - name: Extension deployment service description: A service that enables querying for extension deployment information. externalDocs: description: Find out more about extensions in our documentation. url: https://coralogix.com/docs/integrations/extensions/ - name: Extension service description: A service that enables querying for extension information. externalDocs: description: Learn more about extensions in our documentation. url: https://coralogix.com/docs/integrations/extensions/ - name: Folders for views service description: Create and manage view folders. externalDocs: url: '' - name: Global routers service description: >- View and manage your global routers - entities that direct notifications to configured destinations based on conditions externalDocs: description: Lean more about global routers in our documentation url: >- https://coralogix.com/docs/user-guides/notification-center/routing/introduction/ - name: IP access service description: >- IP access service provides the API for managing company IP access settings. externalDocs: url: '' - name: Incidents service description: >- Handle all operations related to incident management within Coralogix. Identify, manage, and resolve incidents efficiently through automated workflows and team collaboration. externalDocs: description: Find out more about incident management in our documentation url: https://coralogix.com/docs/user-guides/alerting/incidents/ - name: Integration service description: A service that enables querying for integration information. externalDocs: description: Find out more about integrations in our documentation. url: https://coralogix.com/docs/integrations/getting-started/ - name: Metrics Data Archive Service description: View and manage your storage targets for metrics. externalDocs: description: Find out more about archives url: >- https://coralogix.com/docs/user-guides/data-flow/s3-archive/connect-s3-archive/ - name: Notifications testing service description: >- Test your notification center configurations including connectors, presets, and templates externalDocs: description: Lean more about the notification center in our documentation url: https://coralogix.com/docs/user-guides/notification-center/introduction/ - name: Outgoing webhooks service externalDocs: description: Find out more about outbound webhooks in our documentation. url: >- https://coralogix.com/docs/user-guides/alerting/outbound-webhooks/generic-outbound-webhooks-alert-webhooks/ - name: Policies Service description: View and manage your TCO policies externalDocs: url: '' - name: Presets service description: >- View and manage your presets - pre-configured templates for notification content rendering externalDocs: description: Lean more about presets in our documentation url: >- https://coralogix.com/docs/user-guides/notification-center/presets/introduction/ - name: Quota Allocation Rule Set service description: Manage quota allocation rules for different entity types. externalDocs: url: '' - name: Recording Rules Service description: A service to manage recording rules. externalDocs: url: '' - name: Retentions Service description: View and manage retentions externalDocs: url: '' - name: Role Management Service description: Service for managing system and custom roles. externalDocs: url: '' - name: Rule Groups Service description: A service to manage rule groups. externalDocs: url: '' - name: SAML Configuration Service description: Manage your SAML configuration externalDocs: url: '' - name: Scopes Service description: A service to manage scopes externalDocs: url: '' - name: Slos Service description: A service for managing Service Level Objectives (SLOs). externalDocs: url: '' - name: Target Service description: View and manage your storage targets for logs. externalDocs: description: Find out more about archives url: >- https://coralogix.com/docs/user-guides/data-flow/s3-archive/connect-s3-archive/ - name: Team Groups Management Service description: Manage Team Groups. externalDocs: url: '' - name: Users Management Service description: >- Manage team members (users) including creation, updates, search, and status management. externalDocs: url: '' - name: Views service description: Create and manage views. externalDocs: url: '' paths: /incidents/aggregations/v1: get: tags: - Incidents service summary: Get incident aggregations description: >- Retrieve aggregated incident data with support for grouping and filtering. Requires the following permissions: - `incidents:read` operationId: IncidentsService_ListIncidentAggregations parameters: - description: Filter for incidents in: query name: filter required: false schema: description: Filter configuration for incidents externalDocs: url: '' properties: applicationName: minItems: 0 type: array items: minLength: 0 type: string description: Filter by application names description: Filter by application names assignee: minItems: 0 type: array items: minLength: 0 type: string description: Filter by assignee description: Filter by assignee contextualLabels: type: object additionalProperties: $ref: '#/components/schemas/ContextualLabelValues' description: Filter by contextual labels createdAtRange: $ref: '#/components/schemas/v1.TimeRange' displayLabels: type: object additionalProperties: $ref: '#/components/schemas/DisplayLabelValues' description: Filter by display labels endTime: minLength: 0 type: string description: >- Filters all incidents that were open in the given timeframe end time (deprecated, use incident_open_range instead) format: date-time deprecated: true incidentDurationRange: $ref: '#/components/schemas/v1.TimeRange' isMuted: type: boolean description: Indicates if the incident is muted metaLabels: description: Filters all incidents with the given meta labels items: title: Incident meta label type: object properties: key: minLength: 0 type: string description: The key. example: key value: minLength: 0 type: string description: The value. example: value description: Meta label. externalDocs: url: '' minItems: 0 type: array metaLabelsOp: $ref: '#/components/schemas/v1.FilterOperator' searchQuery: $ref: '#/components/schemas/IncidentSearchQuery' severity: minItems: 0 type: array items: $ref: '#/components/schemas/IncidentSeverity' description: Filter by incident severity startTime: minLength: 0 type: string description: >- Filters all incidents that were open in the given timeframe start time (deprecated, use incident_open_range instead) format: date-time deprecated: true state: minItems: 0 type: array items: $ref: '#/components/schemas/IncidentState' description: Filter by incident state status: minItems: 0 type: array items: $ref: '#/components/schemas/IncidentStatus' description: Filter by incident status subsystemName: minItems: 0 type: array items: minLength: 0 type: string description: Filter by subsystem names description: Filter by subsystem names title: Incident query filter type: object - description: Group by fields for aggregation in: query name: group_bys required: false schema: description: Group by fields for aggregation items: title: Incident group by type: object oneOf: - required: - incidentField type: object - required: - contextualLabel type: object properties: contextualLabel: minLength: 0 type: string description: The contextual label to group by. incidentField: $ref: '#/components/schemas/IncidentFields' orderByDirection: $ref: '#/components/schemas/v1.OrderByDirection' externalDocs: url: '' minItems: 0 type: array - description: Pagination parameters in: query name: pagination required: false schema: title: Pagination request required: - pageSize type: object properties: pageSize: minimum: 0 type: integer description: Number of items to return per page format: int64 example: 10 pageToken: minLength: 0 type: string description: Token for the next page of results example: next_page_token description: Pagination parameters for list requests externalDocs: url: '' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListIncidentAggregationsResponse' description: '' '400': content: application/json: schema: $ref: '#/components/schemas/Error' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/Error' description: Unauthorized request '500': content: application/json: schema: $ref: '#/components/schemas/Error' description: Internal server error externalDocs: url: '' components: schemas: ContextualLabelValues: title: Contextual label values required: - contextualLabelValues type: object properties: contextualLabelValues: minItems: 0 type: array items: minLength: 0 type: string description: The contextual label values. description: The contextual label values. description: Represents contextual label values for filtering incidents externalDocs: url: '' v1.TimeRange: title: Time range required: - startTime - endTime type: object properties: endTime: minLength: 0 type: string description: End time of the range format: date-time startTime: minLength: 0 type: string description: Start time of the range format: date-time description: Represents a time range with start and end timestamps externalDocs: url: '' DisplayLabelValues: title: Display label values required: - displayLabelValues type: object properties: displayLabelValues: minItems: 0 type: array items: minLength: 0 type: string description: The display label values. description: The display label values. description: Represents display label values for filtering incidents externalDocs: url: '' v1.FilterOperator: enum: - FILTER_OPERATOR_OR_OR_UNSPECIFIED - FILTER_OPERATOR_AND type: string description: Filter operator. IncidentSearchQuery: title: Incident search query required: - query type: object oneOf: - required: - incidentField type: object - required: - contextualLabel type: object properties: contextualLabel: minLength: 0 type: string description: The contextual label to search in. incidentField: $ref: '#/components/schemas/IncidentFields' query: minLength: 0 type: string description: The search query example: error description: Incident search query. externalDocs: url: '' IncidentSeverity: enum: - INCIDENT_SEVERITY_UNSPECIFIED - INCIDENT_SEVERITY_INFO - INCIDENT_SEVERITY_WARNING - INCIDENT_SEVERITY_ERROR - INCIDENT_SEVERITY_CRITICAL - INCIDENT_SEVERITY_LOW type: string description: Incident severity. IncidentState: enum: - INCIDENT_STATE_UNSPECIFIED - INCIDENT_STATE_TRIGGERED - INCIDENT_STATE_RESOLVED type: string description: Incident state. IncidentStatus: enum: - INCIDENT_STATUS_UNSPECIFIED - INCIDENT_STATUS_TRIGGERED - INCIDENT_STATUS_ACKNOWLEDGED - INCIDENT_STATUS_RESOLVED type: string description: Incident status. IncidentFields: enum: - INCIDENTS_FIELDS_UNSPECIFIED - INCIDENTS_FIELDS_ID - INCIDENTS_FIELDS_SEVERITY - INCIDENTS_FIELDS_NAME - INCIDENTS_FIELDS_CREATED_TIME - INCIDENTS_FIELDS_CLOSED_TIME - INCIDENTS_FIELDS_STATE - INCIDENTS_FIELDS_STATUS - INCIDENTS_FIELDS_LAST_STATE_UPDATE_TIME - INCIDENTS_FIELDS_APPLICATION_NAME - INCIDENTS_FIELDS_SUBSYSTEM_NAME - INCIDENTS_FIELDS_DURATION type: string description: Incident fields. v1.OrderByDirection: enum: - ORDER_BY_DIRECTION_UNSPECIFIED - ORDER_BY_DIRECTION_ASC - ORDER_BY_DIRECTION_DESC type: string description: Order by direction. ListIncidentAggregationsResponse: title: List incident aggregations response required: - incidentAggs - pagination type: object properties: incidentAggs: minItems: 0 type: array items: $ref: '#/components/schemas/IncidentAggregation' description: List of incident aggregations pagination: $ref: '#/components/schemas/incidents.v1.PaginationResponse' description: Response containing aggregated incident data and pagination information externalDocs: url: '' Error: type: object properties: code: maximum: 599 minimum: 100 type: integer description: HTTP status code of the error (for example 400, 404, 500). format: int32 message: maxLength: 4096 minLength: 0 pattern: ^[\s\S]*$ type: string description: Human-readable description of the error. description: Standard error response body returned for a failed request. IncidentAggregation: title: Incident aggregation required: - groupBysValue - aggStateCount - aggStatusCount - aggSeverityCount - aggAssignmentsCount - firstCreatedAt - lastClosedAt - allValuesCount - listIncidentsId - lastStateUpdateTime - aggMetaLabelsCount type: object properties: aggAssignmentsCount: minItems: 0 type: array items: $ref: '#/components/schemas/IncidentAssignmentCount' description: The agg assignments count. aggMetaLabelsCount: minItems: 0 type: array items: $ref: '#/components/schemas/IncidentMetaLabelsCount' description: The agg meta labels count. aggSeverityCount: minItems: 0 type: array items: $ref: '#/components/schemas/IncidentSeverityCount' description: The agg severity count. aggStateCount: minItems: 0 type: array items: $ref: '#/components/schemas/IncidentStateCount' description: The agg state count. aggStatusCount: minItems: 0 type: array items: $ref: '#/components/schemas/IncidentStatusCount' description: The agg status count. allValuesCount: minimum: 0 type: integer description: The all values count. format: int64 firstCreatedAt: minLength: 0 type: string description: The first created at. format: date-time groupBysValue: minItems: 0 type: array items: $ref: '#/components/schemas/GroupByValues' description: The group bys value. lastClosedAt: minLength: 0 type: string description: The last closed at. format: date-time lastStateUpdateTime: minLength: 0 type: string description: The last state update time. format: date-time listIncidentsId: minItems: 0 type: array items: minLength: 0 type: string description: The list incidents id. description: The list incidents id. externalDocs: url: '' incidents.v1.PaginationResponse: title: Pagination response required: - totalSize type: object properties: nextPageToken: minLength: 0 type: string description: Token for the next page of results example: next_page_token totalSize: minimum: 0 type: integer description: Total number of items available format: int64 example: 100 description: Pagination information for list responses externalDocs: url: '' IncidentAssignmentCount: title: Incident assignment count required: - assignedTo - count type: object properties: assignedTo: $ref: '#/components/schemas/incidents.v1.UserDetails' count: minimum: 0 type: integer description: Number of items. format: int64 example: 10 externalDocs: url: '' IncidentMetaLabelsCount: title: Incident meta labels count required: - metaLabel - count type: object properties: count: minimum: 0 type: integer description: Number of items. format: int64 example: 10 metaLabel: $ref: '#/components/schemas/incidents.v1.MetaLabel' externalDocs: url: '' IncidentSeverityCount: title: Incident severity count required: - severity - count type: object properties: count: minimum: 0 type: integer description: Number of items. format: int64 example: 10 severity: $ref: '#/components/schemas/IncidentSeverity' externalDocs: url: '' IncidentStateCount: title: Incident state count required: - state - count type: object properties: count: minimum: 0 type: integer description: Number of items. format: int64 example: 10 state: $ref: '#/components/schemas/IncidentState' externalDocs: url: '' IncidentStatusCount: title: Incident status count required: - status - count type: object properties: count: minimum: 0 type: integer description: Number of items. format: int64 example: 10 status: $ref: '#/components/schemas/IncidentStatus' externalDocs: url: '' GroupByValues: type: object oneOf: - required: - incidentField type: object - required: - contextualLabels type: object - type: object not: anyOf: - required: - incidentField type: object - required: - contextualLabels type: object properties: contextualLabels: $ref: '#/components/schemas/ContextualLabels' incidentField: $ref: '#/components/schemas/IncidentFieldOneOf' incidents.v1.UserDetails: title: User details required: - userId type: object properties: userId: minLength: 0 type: string description: The user id. example: user_id description: User details. externalDocs: url: '' incidents.v1.MetaLabel: title: Incident meta label type: object properties: key: minLength: 0 type: string description: The key. example: key value: minLength: 0 type: string description: The value. example: value description: Meta label. externalDocs: url: '' ContextualLabels: title: Incident contextual labels required: - fieldName - fieldValue type: object properties: fieldName: minLength: 0 type: string description: The field name. example: field_name fieldValue: minLength: 0 type: string description: The field value. example: field_value description: Contextual labels. externalDocs: url: '' IncidentFieldOneOf: type: object oneOf: - required: - id type: object - required: - severity type: object - required: - name type: object - required: - createdAt type: object - required: - closedAt type: object - required: - state type: object - required: - status type: object - required: - lastStateUpdateTime type: object - required: - applicationName type: object - required: - subsystemName type: object - required: - duration type: object - type: object not: anyOf: - required: - id type: object - required: - severity type: object - required: - name type: object - required: - createdAt type: object - required: - closedAt type: object - required: - state type: object - required: - status type: object - required: - lastStateUpdateTime type: object - required: - applicationName type: object - required: - subsystemName type: object - required: - duration type: object properties: applicationName: minLength: 0 type: string description: Application associated with the incident. closedAt: minLength: 0 type: string description: Timestamp when the incident was closed. format: date-time createdAt: minLength: 0 type: string description: Timestamp when the incident was created. format: date-time duration: minLength: 0 type: string description: Duration. id: minLength: 0 type: string description: Unique identifier of the incident. lastStateUpdateTime: minLength: 0 type: string description: Timestamp of the most recent state change. format: date-time name: minLength: 0 type: string description: Display name of the incident. severity: $ref: '#/components/schemas/IncidentSeverity' state: $ref: '#/components/schemas/IncidentState' status: $ref: '#/components/schemas/IncidentStatus' subsystemName: minLength: 0 type: string description: Subsystem associated with the incident. description: Incident field one of. externalDocs: url: '' securitySchemes: apiKeyAuth: type: apiKey in: header name: Authorization description: API key authentication ````