openapi: 3.2.0 info: title: Conure Report API version: conure-218-1-ee422dee license: name: All Rights Reserved url: https://www.cisco.com contact: name: Cisco Security Business Group -- Advanced Threat email: cisco-intel-api-support@cisco.com description: XDR High Priority Incident and Investigation API x-provenance: method: harvested authored_by: Cisco XDR harvested_by: API Evangelist harvested_on: '2026-08-19' first_party: true provider_published: true source_host: visibility.amp.cisco.com note: Anonymously fetchable Swagger 2.0 for nine IROH services plus the CTIA threat-intelligence API. The host returns real 404s on invented paths, so the 200s are genuine. x-evidence: - type: source url: https://visibility.amp.cisco.com/iroh/iroh-int/swagger.json - type: source url: https://private.intel.amp.cisco.com/swagger.json tags: - name: Report paths: /v2/report/incident-status-by-assignment: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: array items: type: object properties: {} application/transit+msgpack: schema: type: array items: type: object properties: {} application/transit+json: schema: type: array items: type: object properties: {} application/edn: schema: type: array items: type: object properties: {} '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: Incident counts by status and assignment bucket security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportIncidentStatusByAssignment x-operation-id-source: derived /v2/report/mitre-attack-incidents: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: array items: type: object properties: {} application/transit+msgpack: schema: type: array items: type: object properties: {} application/transit+json: schema: type: array items: type: object properties: {} application/edn: schema: type: array items: type: object properties: {} '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: Non-closed incident counts by MITRE tactic and technique description: 'Each tactic''s `incident_count` is the number of distinct non-closed incidents mapped to that tactic in the selected period. Each technique''s `incident_count` is the number of distinct incidents mapped to that technique (subtechniques roll up to their parent technique). The sum of per-technique counts under a tactic may differ from the tactic-level count: an incident typically maps to several techniques within the same tactic, so it is counted once at the tactic level but once per technique it maps to at the technique level. Clients should use the tactic-level count for tactic totals, not a sum over techniques.' security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportMitreAttackIncidents x-operation-id-source: derived /v2/report/top-seen-techniques: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: array items: type: object properties: {} application/transit+msgpack: schema: type: array items: type: object properties: {} application/transit+json: schema: type: array items: type: object properties: {} application/edn: schema: type: array items: type: object properties: {} '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: Top seen techniques across incidents security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportTopSeenTechniques x-operation-id-source: derived /v2/report/detection-sources-histogram: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: array items: type: object properties: {} application/transit+msgpack: schema: type: array items: type: object properties: {} application/transit+json: schema: type: array items: type: object properties: {} application/edn: schema: type: array items: type: object properties: {} '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: Daily incident counts per detection source description: 'Returns one row per `(detection_source, day)` pair where `day` is the UTC-aligned calendar day on which the incident was created. Each `incident_count` is the number of distinct non-deleted incidents in the requesting org tagged with that detection source on that day. An incident tagged with multiple detection sources on the same day contributes 1 to each source''s bucket on that day; the sum of per-source counts is therefore ≥ the total incident count for the period. Empty `(source, day)` pairs are omitted from the response — clients that need zero-filled time series should reshape on their end.' security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportDetectionSourcesHistogram x-operation-id-source: derived /v2/report/top-targeted-devices: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: array items: type: object properties: {} application/transit+msgpack: schema: type: array items: type: object properties: {} application/transit+json: schema: type: array items: type: object properties: {} application/edn: schema: type: array items: type: object properties: {} '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: Top targeted devices across incidents security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportTopTargetedDevices x-operation-id-source: derived /v2/report/top-targeted-users: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: array items: type: object properties: {} application/transit+msgpack: schema: type: array items: type: object properties: {} application/transit+json: schema: type: array items: type: object properties: {} application/edn: schema: type: array items: type: object properties: {} '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: Top targeted users across incidents security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportTopTargetedUsers x-operation-id-source: derived /v2/report/top-targeted-assets: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: array items: type: object properties: {} application/transit+msgpack: schema: type: array items: type: object properties: {} application/transit+json: schema: type: array items: type: object properties: {} application/edn: schema: type: array items: type: object properties: {} '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: Top targeted assets across incidents security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportTopTargetedAssets x-operation-id-source: derived /v2/report/team-mean-time-to-engage: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/transit+msgpack: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/transit+json: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/edn: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: Team mean time to engage over the period description: Returns `{current_avg, prior_avg}` in seconds, averaged over incidents in the requesting org created during the selected period (`current_avg`) and during the immediately-preceding window of the same size (`prior_avg`). Each value is the rounded mean of `(opened - created_at)` in seconds — the queue time before an analyst moved the incident off New. Rows where `opened < created_at` (CTIA/distributor clock skew, backfilled imports) are excluded. A window with no qualifying incidents yields `null`. Clients compute the delta to render period-over-period. security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportTeamMeanTimeToEngage x-operation-id-source: derived /v2/report/user-mean-time-to-engage: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/transit+msgpack: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/transit+json: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/edn: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: Requesting user's mean time to engage over the period description: Same shape and semantics as `/team-mean-time-to-engage`, additionally filtered to incidents the requesting user is assigned to via `incident_assignee`. The user is taken from the JWT caller — there is no `?user_id=` parameter. A user with no qualifying assigned incidents in a window yields `null` for that window's average. security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportUserMeanTimeToEngage x-operation-id-source: derived /v2/report/team-mean-time-to-contain: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/transit+msgpack: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/transit+json: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/edn: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: Team mean time to contain over the period description: Returns `{current_avg, prior_avg}` in seconds, averaged over incidents in the requesting org created during the selected period (`current_avg`) and during the immediately-preceding window of the same size (`prior_avg`). Each value is the rounded mean of `(contained - created_at)` in seconds — the containment time from incident creation to when it was marked contained. Rows where `contained < created_at` (CTIA/distributor clock skew, backfilled imports) are excluded. Rows where `contained` is `NULL` are also excluded — pre-deploy incidents (before migration 20260605120000) and incidents that have not been contained both fall in this bucket; the column populates fully within ~30 days of deploy, which matches the dashboard's max window. A window with no qualifying incidents yields `null`. Clients compute the delta to render period-over-period. security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportTeamMeanTimeToContain x-operation-id-source: derived /v2/report/user-mean-time-to-contain: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/transit+msgpack: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/transit+json: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/edn: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: User mean time to contain over the period description: Same shape and semantics as `team-mean-time-to-contain`, but restricted to incidents the requesting user is assigned to via `incident_assignee`. An incident with multiple assignees is counted once for each assignee — the user's own `current_avg` is unaffected by other assignees on the same incident. security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportUserMeanTimeToContain x-operation-id-source: derived /v2/report/team-mean-time-to-resolve: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/transit+msgpack: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/transit+json: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/edn: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: Team mean time to resolve over the period description: 'Returns `{current_avg, prior_avg}` in seconds, averaged over incidents in the requesting org created during the selected period (`current_avg`) and during the immediately-preceding window of the same size (`prior_avg`). Each value is the rounded mean of `(closed - opened)` in seconds, where `opened` is the timestamp the incident was first set to a non-`New` status (incidents created already at a non-`New` status contribute a near-zero `(opened - created_at)` and a real `(closed - opened)` once they close). Never-closed incidents are excluded (the delta is undefined). Rows where `closed < opened` (CTIA/distributor clock skew, backfilled imports) are also excluded. A window with no qualifying incidents yields `null`. Clients compute the delta to render period-over-period. Window bucketing matches the engage tile: incidents are filtered by `created_at` within the period, then their `(closed - opened)` is averaged. Long-tail incidents that haven''t closed yet by query time aren''t included in the average — a survivorship bias accepted in exchange for cross-tile consistency.' security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportTeamMeanTimeToResolve x-operation-id-source: derived /v2/report/user-mean-time-to-resolve: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/transit+msgpack: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/transit+json: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg application/edn: schema: type: object properties: current_avg: type: - integer - 'null' format: int64 prior_avg: type: - integer - 'null' format: int64 required: - current_avg - prior_avg '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: period description: '' required: false schema: type: string enum: - last_hour - last_24_hours - last_7_days - last_30_days - last_60_days - last_90_days tags: - Report summary: Requesting user's mean time to resolve over the period description: 'Same as `/team-mean-time-to-resolve`, but restricted to incidents the requesting user is assigned to via `incident_assignee`. The user is identified from the JWT, not from a query parameter — clients cannot query MTTR for another user. Tokens without a user claim (e.g. service tokens) get a 400 response — use the team variant for org-wide numbers. Each value is the rounded mean of `(closed - opened)` in seconds for incidents created during the period and assigned to the requesting user. A user may be one of several assignees on an incident; the incident still counts exactly once for their average.' security: - JWT-Bearer: [] - oauth2: [] operationId: getV2ReportUserMeanTimeToResolve x-operation-id-source: derived components: securitySchemes: JWT-Bearer: type: apiKey name: Authorization in: header oauth2: type: oauth2 flows: authorizationCode: scopes: event:read: Get event information for an org. Needed to get full report information. private-intel:read: Read data from private intel. Needed to get investigation data. private-intel: Full private intel integration scope. asset: Get Data from Device Insights. Needed during running investigations. enrich:read: Fetch Data about observables. Needed for investigations. integration:read: Get module information. Needed to create a new investigation. investigation: Run investigations. Needed for investigations. casebook: Full casebook management access. Allows read, write to casebooks. casebook:read: Read Casebook access global-intel:read: Read data from public intel. Needed to fetch global incident data and investigations. private-intel:write: Private intel write scope. ao: Execute and read workflows playbook:read: Get playbook state. Needed to get full report information. authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token x-id: - reitit.swagger/default