> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coralogix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List incident events with filters

> List incident events with support for filtering, pagination, and ordering.

Requires the following permissions:
- `incidents:read`



## OpenAPI

````yaml openapi_v5.yaml get /incidents/events/v1
openapi: 3.0.0
info:
  title: ''
  version: 1.0.0
servers:
  - url: https://api.coralogix.com/mgmt/openapi/5
  - url: https://api.eu2.coralogix.com/mgmt/openapi/5
  - url: https://api.coralogix.us/mgmt/openapi/5
  - url: https://api.cx498.coralogix.com/mgmt/openapi/5
  - url: https://api.coralogix.in/mgmt/openapi/5
  - url: https://api.coralogixsg.com/mgmt/openapi/5
  - url: https://api.ap3.coralogix.com/mgmt/openapi/5
security:
  - apiKeyAuth: []
tags:
  - name: AI Applications Service
    description: Manage the catalog of AI applications discovered from spans.
    externalDocs:
      url: ''
  - name: AI Evaluations Service
    description: >-
      Manage AI evaluations and the custom evaluation catalog for AI
      applications.
    externalDocs:
      url: ''
  - name: API Keys Admin Service
    description: Administrative operations for API Keys management.
    externalDocs:
      url: ''
  - name: API Keys Service
    description: Manage your API Keys.
    externalDocs:
      url: ''
  - name: Actions Service
    description: View and manage your Actions.
    externalDocs:
      url: ''
  - name: Alert Scheduler Rule service
    description: Manage your alert scheduler rules.
    externalDocs:
      url: ''
  - name: Alert definitions service
    description: >-
      View and manage your alerts using alert definitions - data structures that
      contain the configuration required to create an alert.
    externalDocs:
      description: Learn more about alerts in our documentation
      url: https://coralogix.com/docs/user-guides/alerting/introduction-to-alerts/
  - name: Alert events service
    description: >-
      Get information regarding your alert events - instances of alerts being
      triggered.
    externalDocs:
      description: Learn more about alert events and incidents in our documentation.
      url: https://coralogix.com/docs/user-guides/alerting/incidents/
  - name: Case Events service
    description: Manage case events, comments, and external thread synchronization.
    externalDocs:
      url: ''
  - name: Case Settings service
    description: Manage case settings team configurations.
    externalDocs:
      url: ''
  - name: Cases notification service
    description: Track notification adjacent data for cases.
    externalDocs:
      url: ''
  - name: Cases service
    description: >-
      Manage cases throughout their lifecycle. Create, view, assign,
      acknowledge, unacknowledge, resolve, and close cases to streamline
      investigations and follow-ups.
    externalDocs:
      description: Learn more about Cases in our documentation
      url: https://coralogix.com/docs/user-guides/cases/
  - name: Connector Schema service
    description: Retrieve connector schemas for notification center integrations
    externalDocs:
      description: Learn more about connectors in our documentation
      url: >-
        https://coralogix.com/docs/user-guides/notification-center/connectors/introduction/
  - name: Connectors service
    description: >-
      View and manage your connectors - integration instances for notification
      destinations
    externalDocs:
      description: Lean more about connectors in our documentation
      url: >-
        https://coralogix.com/docs/user-guides/notification-center/connectors/introduction/
  - name: Contextual data integration service
    description: Query for contextual data integration information.
    externalDocs:
      url: ''
  - name: Custom Enrichments Service
    description: Manage your enrichments.
    externalDocs:
      url: ''
  - name: Dashboard folders service
    description: Manage your dashboard folders.
    externalDocs:
      url: ''
  - name: Dashboard service
    description: Get information about the Coralogix Dashboard catalog.
    externalDocs:
      url: ''
  - name: Data Usage Query service
    description: >-
      Query billable data usage through the public Coralogix API using daily or
      hourly bucketed aggregations over supported labels.
    externalDocs:
      url: ''
  - name: Data Usage Service
    description: A service to manage data usage metrics.
    externalDocs:
      url: ''
  - name: Enrichments Service
    description: Manage your enrichments.
    externalDocs:
      url: ''
  - name: Entities service
    description: Query information about registered entities in the notification center
    externalDocs:
      description: Lean more about the notification center in our documentation
      url: https://coralogix.com/docs/user-guides/notification-center/introduction/
  - name: Events Service
    description: A service for querying events.
    externalDocs:
      description: Learn more about alerts in our documentation
      url: https://coralogix.com/docs/user-guides/alerting/introduction-to-alerts/
  - name: Events2Metrics Service
    description: Manage your events2metrics.
    externalDocs:
      url: ''
  - name: Extension deployment service
    description: A service that enables querying for extension deployment information.
    externalDocs:
      description: Find out more about extensions in our documentation.
      url: https://coralogix.com/docs/integrations/extensions/
  - name: Extension service
    description: A service that enables querying for extension information.
    externalDocs:
      description: Learn more about extensions in our documentation.
      url: https://coralogix.com/docs/integrations/extensions/
  - name: Folders for views service
    description: Create and manage view folders.
    externalDocs:
      url: ''
  - name: Global routers service
    description: >-
      View and manage your global routers - entities that direct notifications
      to configured destinations based on conditions
    externalDocs:
      description: Lean more about global routers in our documentation
      url: >-
        https://coralogix.com/docs/user-guides/notification-center/routing/introduction/
  - name: IP access service
    description: >-
      IP access service provides the API for managing company IP access
      settings.
    externalDocs:
      url: ''
  - name: Incidents service
    description: >-
      Handle all operations related to incident management within Coralogix.
      Identify, manage, and resolve incidents efficiently through automated
      workflows and team collaboration.
    externalDocs:
      description: Find out more about incident management in our documentation
      url: https://coralogix.com/docs/user-guides/alerting/incidents/
  - name: Integration service
    description: A service that enables querying for integration information.
    externalDocs:
      description: Find out more about integrations in our documentation.
      url: https://coralogix.com/docs/integrations/getting-started/
  - name: Metrics Data Archive Service
    description: View and manage your storage targets for metrics.
    externalDocs:
      description: Find out more about archives
      url: >-
        https://coralogix.com/docs/user-guides/data-flow/s3-archive/connect-s3-archive/
  - name: Notifications testing service
    description: >-
      Test your notification center configurations including connectors,
      presets, and templates
    externalDocs:
      description: Lean more about the notification center in our documentation
      url: https://coralogix.com/docs/user-guides/notification-center/introduction/
  - name: Outgoing webhooks service
    externalDocs:
      description: Find out more about outbound webhooks in our documentation.
      url: >-
        https://coralogix.com/docs/user-guides/alerting/outbound-webhooks/generic-outbound-webhooks-alert-webhooks/
  - name: Policies Service
    description: View and manage your TCO policies
    externalDocs:
      url: ''
  - name: Presets service
    description: >-
      View and manage your presets - pre-configured templates for notification
      content rendering
    externalDocs:
      description: Lean more about presets in our documentation
      url: >-
        https://coralogix.com/docs/user-guides/notification-center/presets/introduction/
  - name: Quota Allocation Rule Set service
    description: Manage quota allocation rules for different entity types.
    externalDocs:
      url: ''
  - name: Recording Rules Service
    description: A service to manage recording rules.
    externalDocs:
      url: ''
  - name: Retentions Service
    description: View and manage retentions
    externalDocs:
      url: ''
  - name: Role Management Service
    description: Service for managing system and custom roles.
    externalDocs:
      url: ''
  - name: Rule Groups Service
    description: A service to manage rule groups.
    externalDocs:
      url: ''
  - name: SAML Configuration Service
    description: Manage your SAML configuration
    externalDocs:
      url: ''
  - name: Scopes Service
    description: A service to manage scopes
    externalDocs:
      url: ''
  - name: Slos Service
    description: A service for managing Service Level Objectives (SLOs).
    externalDocs:
      url: ''
  - name: Target Service
    description: View and manage your storage targets for logs.
    externalDocs:
      description: Find out more about archives
      url: >-
        https://coralogix.com/docs/user-guides/data-flow/s3-archive/connect-s3-archive/
  - name: Team Groups Management Service
    description: Manage Team Groups.
    externalDocs:
      url: ''
  - name: Users Management Service
    description: >-
      Manage team members (users) including creation, updates, search, and
      status management.
    externalDocs:
      url: ''
  - name: Views service
    description: Create and manage views.
    externalDocs:
      url: ''
paths:
  /incidents/events/v1:
    get:
      tags:
        - Incidents service
      summary: List incident events with filters
      description: >-
        List incident events with support for filtering, pagination, and
        ordering.


        Requires the following permissions:

        - `incidents:read`
      operationId: IncidentsService_ListIncidentEvents
      parameters:
        - description: Filter for incident events
          in: query
          name: filter
          required: false
          schema:
            title: Incident event query filter
            type: object
            properties:
              contextualLabels:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/ContextualLabelValues'
                description: The contextual labels of the incident
              displayLabels:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/DisplayLabelValues'
                description: The display labels of the incident
              isMuted:
                type: boolean
                description: Indicates if the incident is muted
              labels:
                $ref: '#/components/schemas/LabelsFilter'
              name:
                minLength: 0
                type: string
                description: The name of the incident
              severity:
                minItems: 0
                type: array
                items:
                  $ref: '#/components/schemas/IncidentSeverity'
                description: The severity of the incident
              status:
                minItems: 0
                type: array
                items:
                  $ref: '#/components/schemas/IncidentStatus'
                description: The status of the incident
              timestamp:
                $ref: '#/components/schemas/v1.TimeRange'
            description: Filter configuration for incident events
            externalDocs:
              url: ''
        - description: Pagination parameters
          in: query
          name: pagination
          required: false
          schema:
            title: Pagination request
            required:
              - pageSize
            type: object
            properties:
              pageSize:
                minimum: 0
                type: integer
                description: Number of items to return per page
                format: int64
                example: 10
              pageToken:
                minLength: 0
                type: string
                description: Token for the next page of results
                example: next_page_token
            description: Pagination parameters for list requests
            externalDocs:
              url: ''
        - description: Order by fields for incident events
          in: query
          name: order_by
          required: false
          schema:
            title: List incident events order by request
            type: object
            properties:
              direction:
                $ref: '#/components/schemas/v1.OrderByDirection'
              field:
                $ref: '#/components/schemas/IncidentEventOrderByFieldType'
            externalDocs:
              url: ''
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListIncidentEventsResponse'
          description: ''
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Bad Request
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Unauthorized request
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal server error
      externalDocs:
        url: ''
components:
  schemas:
    ContextualLabelValues:
      title: Contextual label values
      required:
        - contextualLabelValues
      type: object
      properties:
        contextualLabelValues:
          minItems: 0
          type: array
          items:
            minLength: 0
            type: string
            description: The contextual label values.
          description: The contextual label values.
      description: Represents contextual label values for filtering incidents
      externalDocs:
        url: ''
    DisplayLabelValues:
      title: Display label values
      required:
        - displayLabelValues
      type: object
      properties:
        displayLabelValues:
          minItems: 0
          type: array
          items:
            minLength: 0
            type: string
            description: The display label values.
          description: The display label values.
      description: Represents display label values for filtering incidents
      externalDocs:
        url: ''
    LabelsFilter:
      title: Label filter configuration
      required:
        - metaLabels
      type: object
      properties:
        metaLabels:
          minItems: 0
          type: array
          items:
            $ref: '#/components/schemas/incidents.v1.MetaLabel'
          description: The meta labels of the incident
        operator:
          $ref: '#/components/schemas/v1.FilterOperator'
      description: >-
        Filter configuration for incident events based on meta labels and their
        combination operator.
      externalDocs:
        url: ''
    IncidentSeverity:
      enum:
        - INCIDENT_SEVERITY_UNSPECIFIED
        - INCIDENT_SEVERITY_INFO
        - INCIDENT_SEVERITY_WARNING
        - INCIDENT_SEVERITY_ERROR
        - INCIDENT_SEVERITY_CRITICAL
        - INCIDENT_SEVERITY_LOW
      type: string
      description: Incident severity.
    IncidentStatus:
      enum:
        - INCIDENT_STATUS_UNSPECIFIED
        - INCIDENT_STATUS_TRIGGERED
        - INCIDENT_STATUS_ACKNOWLEDGED
        - INCIDENT_STATUS_RESOLVED
      type: string
      description: Incident status.
    v1.TimeRange:
      title: Time range
      required:
        - startTime
        - endTime
      type: object
      properties:
        endTime:
          minLength: 0
          type: string
          description: End time of the range
          format: date-time
        startTime:
          minLength: 0
          type: string
          description: Start time of the range
          format: date-time
      description: Represents a time range with start and end timestamps
      externalDocs:
        url: ''
    v1.OrderByDirection:
      enum:
        - ORDER_BY_DIRECTION_UNSPECIFIED
        - ORDER_BY_DIRECTION_ASC
        - ORDER_BY_DIRECTION_DESC
      type: string
      description: Order by direction.
    IncidentEventOrderByFieldType:
      enum:
        - INCIDENT_EVENT_ORDER_BY_FIELD_TYPE_TIMESTAMP_OR_UNSPECIFIED
      type: string
      description: Incident event order by field type.
    ListIncidentEventsResponse:
      title: List incident events response
      required:
        - items
      type: object
      properties:
        items:
          minItems: 0
          type: array
          items:
            $ref: '#/components/schemas/IncidentEventExtended'
          description: List of incident events
        pagination:
          $ref: '#/components/schemas/incidents.v1.PaginationResponse'
      description: >-
        A response containing a list of incident events and pagination
        information
      externalDocs:
        url: ''
    Error:
      type: object
      properties:
        code:
          maximum: 599
          minimum: 100
          type: integer
          description: HTTP status code of the error (for example 400, 404, 500).
          format: int32
        message:
          maxLength: 4096
          minLength: 0
          pattern: ^[\s\S]*$
          type: string
          description: Human-readable description of the error.
      description: Standard error response body returned for a failed request.
    incidents.v1.MetaLabel:
      title: Incident meta label
      type: object
      properties:
        key:
          minLength: 0
          type: string
          description: The key.
          example: key
        value:
          minLength: 0
          type: string
          description: The value.
          example: value
      description: Meta label.
      externalDocs:
        url: ''
    v1.FilterOperator:
      enum:
        - FILTER_OPERATOR_OR_OR_UNSPECIFIED
        - FILTER_OPERATOR_AND
      type: string
      description: Filter operator.
    IncidentEventExtended:
      title: Extended incident event
      required:
        - cxEventKey
        - incidentEvent
        - cxEventTimestamp
      type: object
      properties:
        cxEventKey:
          minLength: 0
          type: string
          description: The cx event key.
        cxEventTimestamp:
          minLength: 0
          type: string
          description: The cx event timestamp.
          format: date-time
        incidentEvent:
          $ref: '#/components/schemas/IncidentEvent'
        incidentEventExtendedMetadata:
          $ref: '#/components/schemas/IncidentEventExtendedMetadata'
      externalDocs:
        url: ''
    incidents.v1.PaginationResponse:
      title: Pagination response
      required:
        - totalSize
      type: object
      properties:
        nextPageToken:
          minLength: 0
          type: string
          description: Token for the next page of results
          example: next_page_token
        totalSize:
          minimum: 0
          type: integer
          description: Total number of items available
          format: int64
          example: 100
      description: Pagination information for list responses
      externalDocs:
        url: ''
    IncidentEvent:
      title: Incident event
      required:
        - id
        - incidentEventType
        - originatorType
      type: object
      allOf:
        - oneOf:
            - required:
                - snoozeIndicator
              type: object
            - required:
                - assignment
              type: object
            - required:
                - unassign
              type: object
            - required:
                - upsertState
              type: object
            - required:
                - acknowledge
              type: object
            - required:
                - close
              type: object
        - oneOf:
            - required:
                - administrativeEvent
              type: object
            - required:
                - operationalEvent
              type: object
      properties:
        acknowledge:
          $ref: '#/components/schemas/IncidentEventAcknowledge'
        administrativeEvent:
          $ref: '#/components/schemas/IncidentEventOriginatorAdministrative'
        assignment:
          $ref: '#/components/schemas/IncidentEventAssign'
        close:
          $ref: '#/components/schemas/IncidentEventClose'
        id:
          minLength: 0
          type: string
          description: The ID of the incident event
          example: incident_event_id
        incidentEventType:
          $ref: '#/components/schemas/IncidentEventType'
        operationalEvent:
          $ref: '#/components/schemas/IncidentEventOriginatorOperational'
        originatorType:
          $ref: '#/components/schemas/OriginatorType'
        snoozeIndicator:
          $ref: '#/components/schemas/IncidentEventSnoozeIndicator'
        unassign:
          $ref: '#/components/schemas/IncidentEventUnassign'
        upsertState:
          $ref: '#/components/schemas/IncidentEventUpsertState'
      description: Incident event.
      externalDocs:
        url: ''
    IncidentEventExtendedMetadata:
      type: object
      properties:
        alertGroupByFields:
          minItems: 0
          type: array
          items:
            minLength: 0
            type: string
            description: The alert group by fields.
          description: The alert group by fields.
        alertId:
          minLength: 0
          type: string
          description: Unique identifier of the alert.
        alertLabels:
          minItems: 0
          type: array
          items:
            $ref: '#/components/schemas/incidents.v1.MetaLabel'
          description: The alert labels.
        alertName:
          minLength: 0
          type: string
          description: The alert name.
        alertType:
          $ref: '#/components/schemas/IncidentEventAlertType'
        incidentPermutation:
          type: object
          additionalProperties:
            minLength: 0
            type: string
          description: The incident permutation.
        incidentSeverity:
          $ref: '#/components/schemas/IncidentSeverity'
        incidentState:
          $ref: '#/components/schemas/IncidentState'
        incidentStatus:
          $ref: '#/components/schemas/IncidentStatus'
        isMuted:
          type: boolean
          description: The is muted.
      description: Incident event extended metadata.
      externalDocs:
        url: ''
    IncidentEventAcknowledge:
      type: object
      properties:
        acknowledgedBy:
          $ref: '#/components/schemas/incidents.v1.UserDetails'
      description: Incident event acknowledge.
      externalDocs:
        url: ''
    IncidentEventOriginatorAdministrative:
      type: object
      properties:
        userId:
          minLength: 0
          type: string
          description: The user id.
      description: Incident event originator administrative.
      externalDocs:
        url: ''
    IncidentEventAssign:
      title: Incident event assignment details
      type: object
      properties:
        assignment:
          $ref: '#/components/schemas/Assignment'
      description: Incident event assign.
      externalDocs:
        url: ''
    IncidentEventClose:
      type: object
      properties:
        closedBy:
          $ref: '#/components/schemas/incidents.v1.UserDetails'
      description: Incident event close.
      externalDocs:
        url: ''
    IncidentEventType:
      enum:
        - INCIDENT_EVENT_TYPE_UNSPECIFIED
        - INCIDENT_EVENT_TYPE_UPSERT_STATE
        - INCIDENT_EVENT_TYPE_OPEN
        - INCIDENT_EVENT_TYPE_CLOSE
        - INCIDENT_EVENT_TYPE_SNOOZE_INDICATOR
        - INCIDENT_EVENT_TYPE_ASSIGN
        - INCIDENT_EVENT_TYPE_UNASSIGN
        - INCIDENT_EVENT_TYPE_ACKNOWLEDGE
      type: string
      description: Incident event type.
    IncidentEventOriginatorOperational:
      type: object
      properties:
        systemName:
          minLength: 0
          type: string
          description: The system name.
      description: Incident event originator operational.
      externalDocs:
        url: ''
    OriginatorType:
      enum:
        - ORIGINATOR_TYPE_UNSPECIFIED
        - ORIGINATOR_TYPE_OPERATIONAL
        - ORIGINATOR_TYPE_ADMINISTRATIVE
      type: string
      description: Originator type.
    IncidentEventSnoozeIndicator:
      title: Incident event snooze indicator
      type: object
      properties:
        durationMinutes:
          type: integer
          description: The duration minutes.
          format: int32
        startTime:
          minLength: 0
          type: string
          description: Start time.
          format: date-time
        userId:
          minLength: 0
          type: string
          description: The user id.
      description: Incident event snooze indicator.
      externalDocs:
        url: ''
    IncidentEventUnassign:
      type: object
      additionalProperties: false
      description: Incident event unassign.
      externalDocs:
        url: ''
    IncidentEventUpsertState:
      title: Incident event upsert state
      required:
        - stateType
        - payload
      type: object
      properties:
        isMuted:
          type: boolean
          description: The is muted.
        payload:
          $ref: '#/components/schemas/UpsertIncidentStatePayload'
        stateType:
          $ref: '#/components/schemas/UpsertIncidentStateType'
      description: Incident event upsert state.
      externalDocs:
        url: ''
    IncidentEventAlertType:
      enum:
        - INCIDENT_EVENT_ALERT_TYPE_STANDARD_OR_UNSPECIFIED
        - INCIDENT_EVENT_ALERT_TYPE_METRIC
        - INCIDENT_EVENT_ALERT_TYPE_NEW_VALUE
        - INCIDENT_EVENT_ALERT_TYPE_RATIO
        - INCIDENT_EVENT_ALERT_TYPE_TIME_RELATIVE
        - INCIDENT_EVENT_ALERT_TYPE_UNIQUE_COUNT
        - INCIDENT_EVENT_ALERT_TYPE_TRACING
        - INCIDENT_EVENT_ALERT_TYPE_FLOW
        - INCIDENT_EVENT_ALERT_TYPE_SLO
      type: string
      description: Incident event alert type.
    IncidentState:
      enum:
        - INCIDENT_STATE_UNSPECIFIED
        - INCIDENT_STATE_TRIGGERED
        - INCIDENT_STATE_RESOLVED
      type: string
      description: Incident state.
    incidents.v1.UserDetails:
      title: User details
      required:
        - userId
      type: object
      properties:
        userId:
          minLength: 0
          type: string
          description: The user id.
          example: user_id
      description: User details.
      externalDocs:
        url: ''
    Assignment:
      title: Assignment
      required:
        - assignedTo
        - assignedBy
      type: object
      properties:
        assignedBy:
          $ref: '#/components/schemas/incidents.v1.UserDetails'
        assignedTo:
          $ref: '#/components/schemas/incidents.v1.UserDetails'
      description: >-
        Details of the user who assigned the incident and the user to whom it
        was assigned
      externalDocs:
        url: ''
    UpsertIncidentStatePayload:
      type: object
      properties:
        cxEventKey:
          minLength: 0
          type: string
          description: The cx event key.
      description: Upsert incident state payload.
      externalDocs:
        url: ''
    UpsertIncidentStateType:
      enum:
        - UPSERT_INCIDENT_STATE_TYPE_UNSPECIFIED
        - UPSERT_INCIDENT_STATE_TYPE_TRIGGERED
        - UPSERT_INCIDENT_STATE_TYPE_RESOLVED
      type: string
      description: Upsert incident state type.
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: Authorization
      description: API key authentication

````