swagger: '2.0'
info:
  title: Huntress API Reference Accounts Incident Reports API
  description: "<!-- DO NOT LINT FOR FORMATTING, you will break how it appears on the docs site -->\n<p><a href='https://www.huntress.com/terms-of-service'>© Huntress - All rights reserved</a></p>\n<h1 id='introduction'>Introduction</h1>\n\n<p>Webhook event payloads are available via the dropdown menu above the search bar on this page.</p>\n\n<p>The Huntress API follows a RESTful pattern. Requests are made via resource-oriented URLs as described in this document and API responses are formatted as JSON data.</p>\n\n<p>A command-line client is also available for interacting with the API from your terminal. It requires Ruby 3.1+ and has no external dependencies. You can download it from <a href='https://api.huntress.io/api/huntress-cli'>https://api.huntress.io/api/huntress-cli</a>.</p>\n\n<p>Alternatively, if you'd prefer to use an MCP, we have <a href=\"https://support.huntress.io/hc/en-us/articles/50846554117395-Connecting-to-the-Huntress-MCP-Server\">instructions for setting up the Huntress MCP</a>. Note that the MCP is read-only, so this is a good option if you're looking for a safer way to access your Huntress data from an LLM.</p>\n\n<p>If you&#39;d like to request additional API endpoints or capabilities, <a href=\"https://feedback.huntress.com/\">submit feedback</a> through our feedback portal.</p>\n\n<h1 id='api-overview'>API Overview</h1>\n<details>\n\t<summary><h2 id='authentication'>Authentication</h2></summary>\n<div class=\"scalar-code-copy\"><pre class=\"scalar-codeblock-pre\"><code class=\"hljs language-curl\"><span class=\"hljs-variable\">$KEY</span> = </span><span class=\"hljs-built_in\">echo </span><span class=\"hljs-string\">\"$HUNTRESS_PUBLIC_KEY:$HUNTRESS_PRIVATE_KEY\"</span> | <span class=\"hljs-built_in\">base64</span>\n<span class=\"hljs-built_in\">curl </span><span class=\"hljs-string\">\"https://api.huntress.io/v1/agents\"</span> \\ -H <span class=\"hljs-string\">\"Authorization: Basic $KEY\"</span>\n</code></pre>\n</div>\n<p>To begin, generate your API Key at <code>&lt;your_account_subdomain&gt;.huntress.io</code>. Once you are logged into your account on the Huntress site, check the dropdown menu at the top-right corner of the site header. You should see <code>API Credentials</code> among the options if your account has been granted access to the Huntress API. Click on the option to continue to the API Key generation page.</p>\n\n<p>Once on the API Key generation page, click on the green Setup button to begin the process to generate your API Key. You will be redirected to a page where you will be prompted to generate your API Key. Click the Generate button to generate a public and private key pair for Huntress API access. The inputs on the page will be filled in with your access credentials once you have done so.</p>\n\n<p><strong>Your API Private Key will only be visible at this stage of API Key generation. Be sure to save the value provided somewhere secure, as once you navigate away from this page, this value will no longer be accessible and you must regenerate your API credentials if your secret key value is lost.</strong></p>\n\n<p>If necessary, you can repeat the process to regenerate your API credentials with a new API Key and API Secret Key on the same API Key generation page, at <code>&lt;your_account_subdomain&gt;.huntress.io/account/api_credentials</code>.</p>\n\n<p>The Huntress API implements basic access authentication. Once you have your API Key and API Secret Key, provide these values as the result of a Base64 encoded string in every request to the Huntress API via the <code>Authorization</code> header. Your request header should look something like <code>Authorization: Basic [Base64Encode(&lt;your_api_key&gt;:&lt;your_api_secret_key&gt;)]</code>. Please refer to the code snippets for further examples.</p>\n</details>\n<details>\n\t<summary><h2 id='rate-limits'>Rate Limits</h2></summary>\n<p>Every Huntress API account is rate limited to 60 requests per minute, on a sliding window. This means that no more than 60 requests can be made within a 60 second time interval between the first request and the last request.</p>\n\n<p>For example, if request 1 is made at T0, request 2 is made at T5, and requests 3 through 60 are made at T10, making request 61 at T55 would result in a 429 error response. Making request 61 at T61 would succeed, however making request 62 at T61 would fail, at least until the time has passed T65, corresponding to a minute after request 2 was made.</p>\n</details>\n<details>\n\t<summary><h2 id='http-response-codes'>HTTP Response Codes</h2></summary>\n<p>Huntress follows HTTP standards when delivering responses: a <code>2xx</code> response is a success, a <code>4xx</code> response indicates an issue with the client request, and a <code>5xx</code> response indicates an issue with Huntress servers.\n<br>\n<br>\nSpecific error codes are detailed in the following table:</p>\n<table><thead>\n<tr>\n<th>Error Status Code</th>\n<th>Details</th>\n</tr>\n</thead><tbody>\n<tr>\n<td>400</td>\n<td>There is an unexpected value in the API request being made.</td>\n</tr>\n<tr>\n<td>401</td>\n<td>Your request could not be authenticated. Check that your API key is properly formatted and included in the <code>Authorization</code> header.</td>\n</tr>\n<tr>\n<td>404</td>\n<td>The requested resource is unavailable: either it doesn&#39;t exist, or your account does not hold correct permissions to access it.</td>\n</tr>\n<tr>\n<td>429</td>\n<td>You have made too many requests within the rate limit timeframe. See the previous section on <a href=\"#rate_limits\">rate_limits</a> for details.</td>\n</tr>\n<tr>\n<td>500</td>\n<td><p>An error has occurred within Huntress servers.</p><p>You could retry the request, but if you encounter continued errors, please <a href=\"https://support.huntress.io\">contact Support</a> with details of your error. If all traffic from Huntress is resulting in 500 responses, please check our <a href=\"https://huntressstatus.statuspage.io/\">Huntress Status Page</a>.</p></td>\n</tr>\n</tbody></table>\n</details>\n<details>\n\t<summary><h2 id='pagination'>Pagination</h2></summary>\n<p>Certain Huntress API endpoints utilize a <code>page_token</code> and <code>limit</code> parameter to specify a window location and size, respectively, to the resources currently being requested.\n<br><br>\nEach API request will also return a pagination object with details about your current pagination state based on the parameters provided. The pagination object contains:<br></p>\n\n<table><thead>\n<tr>\n<th>Key</th>\n<th>Type</th>\n<th>Description</th>\n</tr>\n</thead><tbody>\n<tr>\n<td>next_page_token</td>\n<td>string</td>\n<td>The token used to request the next page in paginated results. If no page token is included, the first page contains all results.</td>\n</tr>\n<tr>\n<td>next_page_url</td>\n<td>string</td>\n<td>URL containing the next page and the limit provided in the original API request, to be used to continue sequentially accessing resources. Only displays when another page can be accessed.</td>\n</tr>\n</tbody></table>\n<br>\n<p>Following is a formatted example of the pagination object in an API response:<br>\n<div class=\"scalar-code-copy\">\n<pre class=\"scalar-codeblock-pre\">\n<code class=\"hljs language-json\"><span class=\"hljs-attr\">\"pagination\"</span><span class=\"hljs-punctuation\">: {</span>\n<span class=\"hljs-attr\">  \"next_page_url\"</span><span class=\"hljs-punctuation\">: </span><span class=\"hljs-string\">\"https://api.huntress.io/v1/agents?page_token=MjAyMi0wMy0wMVQxODo1NDoyNFo&amp;limit=10\"</span><span class=\"hljs-punctuation\">,\n</span><span class=\"hljs-attr\">  \"next_page_token\"</span><span class=\"hljs-punctuation\">: </span><span class=\"hljs-string\">\"MjAyMi0wMy0wMVQxODo1NDoyNFo\"</span><span class=\"hljs-punctuation\">\n}</span></code></pre>\n</div>\n</details>\n<details>\n\t<summary><h2 id='request-and-response-format'>Request and Response Format</h2></summary>\n\t<details>\n\t\t<summary><h3 id='request'>Request</h3></summary>\n\t<div class=\"scalar-code-copy\">\n<pre class=\"scalar-codeblock-pre\">\n<code class=\"hljs language-curl\"><span class=\"hljs-built_in\">curl</span> <span class=\"hljs-string\">\"https://api.huntress.io/v1/agents?organization_id=1&amp;page_token=MjAyMi0wMy0wMVQxODo1NDoyNFo\"</span> -H <span class=\"hljs-string\">\"Authorization: Basic &lt;Your B64 encoded hash&gt;\"</span></code></pre></div>\n\t<p>The base URL for API requests is <code>api.huntress.io/v1/</code>, followed by the resource requested. Resources can be requested either singularly or as a list, which correspond to <code>/v1/&lt;resources&gt;/:id</code> or <code>/v1/&lt;resources&gt;</code> respectively, with the exception of the <code>/v1/account</code> and <code>/v1/actor</code> endpoints, which only returns the account associated with the API credentials provided.</p>\n\t<p>As an example, <code>api.huntress.io/v1/agents</code> would return a list of agents, while <code>api.huntress.io/v1/agents/1</code> would return a singular agent with ID: 1.</p>\n\t<p>Parameters are provided to the API through a query string. As an example, providing the organization_id filter as a parameter to the <code>/v1/agents</code> endpoint would look like <code>api.huntress/io/v1/agents?organization_id=1</code>. Accessing a sequential page with the same filter active would look like <code>api.huntress.io/v1/agents?organization_id=1&amp;page_token=MjAyMi0wMy0wMVQxODo1NDoyNFo</code>.</p>\n\t</details>\n\t<details>\n\t\t<summary><h3 id='response'>Response</h3></summary>\n\t<p>The Huntress API responds with a JSON object containing requested resources if the request is valid and authorized.</p>\n\t<h4 id='singular-case'>Singular Case</h4>\n\t<div class=\"scalar-code-copy\">\n\t<pre class=\"scalar-codeblock-pre\"><code class=\"hljs-json\"><span class=\"hljs-punctuation\">{</span>\n<span class=\"hljs-attr\">  \"report\"</span><span class=\"hljs-punctuation\">: { ... }\n}</span></code>\n</div>\n\t<p>In the case of accessing a singular resource, the JSON object in question will contain one key that maps the singular resource to the singular representation of the resource name. As an example, if you were to request <code>api.huntress.io/v1/reports/1</code>, the JSON response would contain a single key <code>report</code> that maps to the report with ID: 1.</p>\n\t<h4 id='multiple-case'>Multiple Case</h4><div class=\"highlight\"><pre class=\"highlight json tab-json\">\n<pre class=\"scalar-codeblock-pre\"><code  class=\"hljs-json\"><span class=\"hljs-punctuation\">{</span>\n<span class=\"hljs-attr\">  \"reports\"</span><span class=\"hljs-punctuation\">: [ ... ],</span>\n<span class=\"hljs-attr\">  \"pagination\"</span><span class=\"hljs-punctuation\">: { ... }</span>\n<span class=\"hljs-punctuation\">}</span>\n</code></pre></div>\n\t<p>When accessing a list of resources, the JSON response contains two keys at the root level. The first key is the plural representation of that resource. The second is a <code>pagination</code> key that represents the current state of pagination based on parameters provided in the original request. As an example, a request to <code>api.huntress.io/v1/reports</code> returns a JSON object with the keys <code>reports</code> and <code>pagination</code> at its root level. Further details on the fields within the pagination object can be seen at <a href=\"#pagination\">the relevant section</a>.</p>\n\t</details>\n</details>\n"
  version: 1.0.0
host: api.huntress.io
schemes:
- https
produces:
- application/json
security:
- basic:
  - basic_auth
tags:
- name: Incident Reports
  description: Operations about Incident Reports
paths:
  /v1/incident_reports:
    get:
      summary: List Incident Reports
      description: "Shows Incident Reports associated with your account.\n\n**Note:** This endpoint will also return a `pagination` key on the root level.  \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
      produces:
      - application/json
      parameters:
      - in: query
        name: limit
        description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
        type: integer
        format: int32
        default: 10
        minimum: 1
        maximum: 500
        required: false
      - in: query
        name: page_token
        description: Token used to request the next page in paginated results. Defaults to 'null'
        type: string
        required: false
      - in: query
        name: sort_field
        description: Field to sort by. Defaults to 'id'.
        type: string
        default: id
        enum:
        - id
        - created_at
        - updated_at
        required: false
      - in: query
        name: sort_direction
        description: Sort direction. Defaults to 'desc'.
        type: string
        default: desc
        enum:
        - asc
        - desc
        required: false
      - in: query
        name: indicator_type
        description: Filter by indicator type. One of footholds, monitored_files, ransomware_canaries, antivirus_detections, process_detections, managed_identity, mde_detections, siem_detections, favicon_detections, behavioral_detections, email_security_detections, app_control, ai_misuse
        type: string
        enum:
        - footholds
        - monitored_files
        - ransomware_canaries
        - antivirus_detections
        - process_detections
        - managed_identity
        - mde_detections
        - siem_detections
        - favicon_detections
        - behavioral_detections
        - email_security_detections
        - app_control
        - ai_misuse
        required: false
      - in: query
        name: status
        description: Filter by status. One of sent, closed, dismissed, auto_remediating, deleting, partner_dismissed
        type: string
        enum:
        - sent
        - closed
        - dismissed
        - auto_remediating
        - deleting
        - partner_dismissed
        required: false
      - in: query
        name: severity
        description: Filter by severity. One of low, high, critical
        type: string
        enum:
        - low
        - high
        - critical
        required: false
      - in: query
        name: platform
        description: Filter by platform. One of windows, darwin, microsoft_365, google, linux, email_security, other
        type: string
        enum:
        - windows
        - darwin
        - microsoft_365
        - google
        - linux
        - email_security
        - other
        required: false
      - in: query
        name: organization_id
        description: Filter by organization ID within Huntress account
        type: integer
        format: int32
        required: false
      - in: query
        name: agent_id
        description: Filter by agent ID within Huntress account
        type: integer
        format: int32
        required: false
      responses:
        '200':
          description: List Incident Reports
          schema:
            type: object
            properties:
              incident_reports:
                type: array
                items:
                  $ref: '#/definitions/IncidentReport'
              pagination:
                $ref: '#/definitions/Pagination'
            required:
            - incident_reports
            - pagination
        '403':
          description: There was an issue with your API credential or permissions.
          schema:
            $ref: '#/definitions/IncidentReport'
      tags:
      - Incident Reports
      operationId: getV1IncidentReports
  /v1/incident_reports/{id}:
    get:
      summary: Get Incident Report
      description: Shows details on a single Incident Report associated with your account.
      produces:
      - application/json
      parameters:
      - in: path
        name: id
        description: Incident Report ID within Huntress account
        type: integer
        format: int32
        required: true
      responses:
        '200':
          description: Get Incident Report
          schema:
            type: object
            properties:
              incident_report:
                $ref: '#/definitions/IncidentReport'
        '403':
          description: There was an issue with your API credential or permissions.
          schema:
            $ref: '#/definitions/IncidentReport'
      tags:
      - Incident Reports
      operationId: getV1IncidentReportsId
  /v1/incident_reports/{id}/resolution:
    post:
      summary: Create an Incident Report Resolution
      description: 'Use this endpoint to resolve a single Incident Report. All remediations belonging to the Incident Report must be approved first.


        While resolution updates the report status to resolved, assisted remediations may still be running in the background and manual remediations may still require completion by a user.


        This endpoint requires an API key with permissions to resolve incident reports. **Note that the default account API key is read-only, so you''ll need to create a user-based API key with the appropriate permissions to access this endpoint**.

        '
      produces:
      - application/json
      consumes:
      - application/json
      parameters:
      - in: path
        name: id
        type: integer
        format: int32
        required: true
      responses:
        '201':
          description: Create an Incident Report Resolution
          schema:
            type: object
            properties:
              incident_report:
                $ref: '#/definitions/IncidentReport'
        '403':
          description: There was an issue with your API credential or permissions.
        '409':
          description: Incident Report cannot be resolved. Confirm that all remediations are approved and report status is 'sent'.
        '422':
          description: Incident Report cannot be resolved unless report status is 'sent'.
      tags:
      - Incident Reports
      operationId: postV1IncidentReportsIdResolution
  /v1/incident_reports/{incident_report_id}/remediations:
    get:
      summary: List Remediations
      description: "Shows details of Remediations belonging to a single Incident Report.\n\n**Note:** This endpoint will also return a `pagination` key on the root level.  \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
      produces:
      - application/json
      parameters:
      - in: path
        name: incident_report_id
        type: integer
        format: int32
        required: true
      - in: query
        name: limit
        description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
        type: integer
        format: int32
        default: 10
        minimum: 1
        maximum: 500
        required: false
      - in: query
        name: page_token
        description: Token used to request the next page in paginated results. Defaults to 'null'
        type: string
        required: false
      - in: query
        name: sort_field
        description: Field to sort by. Defaults to 'id'.
        type: string
        default: id
        enum:
        - id
        - created_at
        - updated_at
        required: false
      - in: query
        name: sort_direction
        description: Sort direction. Defaults to 'desc'.
        type: string
        default: desc
        enum:
        - asc
        - desc
        required: false
      - in: query
        name: types[]
        description: 'Filter by type of remediation. Must be a comma-separated string containing the values: assisted, manual, containment'
        type: array
        items:
          type: string
          enum:
          - assisted
          - manual
          - containment
        required: false
      - in: query
        name: statuses[]
        description: 'Filter by status of remediation. Must be a comma-separated string containing the values: unapproved, approved, completed, failed, cancelled'
        type: array
        items:
          type: string
          enum:
          - unapproved
          - approved
          - completed
          - failed
          - cancelled
        required: false
      responses:
        '200':
          description: List Remediations
          schema:
            type: object
            properties:
              remediations:
                type: array
                items:
                  $ref: '#/definitions/Remediation'
              pagination:
                $ref: '#/definitions/Pagination'
            required:
            - remediations
            - pagination
        '403':
          description: There was an issue with your API credential or permissions.
          schema:
            $ref: '#/definitions/Remediation'
      tags:
      - Incident Reports
      operationId: getV1IncidentReportsIncidentReportIdRemediations
  /v1/incident_reports/{incident_report_id}/remediations/{remediation_id}:
    get:
      summary: Get Remediation
      description: Shows details for a single Remediation belonging to a single Incident Report
      produces:
      - application/json
      parameters:
      - in: path
        name: incident_report_id
        type: integer
        format: int32
        required: true
      - in: path
        name: remediation_id
        description: Incident Report ID
        type: integer
        format: int32
        required: true
      responses:
        '200':
          description: Get Remediation
          schema:
            type: object
            properties:
              remediation:
                $ref: '#/definitions/Remediation'
        '403':
          description: There was an issue with your API credential or permissions.
          schema:
            $ref: '#/definitions/Remediation'
      tags:
      - Incident Reports
      operationId: getV1IncidentReportsIncidentReportIdRemediationsRemediationId
  /v1/incident_reports/{incident_report_id}/remediations/bulk_approval:
    post:
      summary: Bulk Approve Remediations
      description: 'Approve all unapproved remediations for an Incident Report. Approval immediately triggers the execution of assisted remediations.

        Manual remediations are not executed, and must be independently completed. Once all remediations are approved,

        the incident report becomes eligible for resolution.


        This endpoint requires an API key with permissions to write to remediations. **Note that the default account API key is read-only, so you''ll need to create a user-based API key with the appropriate permissions to access this endpoint**.

        '
      produces:
      - application/json
      consumes:
      - application/json
      parameters:
      - in: path
        name: incident_report_id
        type: integer
        format: int32
        required: true
      responses:
        '201':
          description: Bulk Approve Remediations
          schema:
            type: object
            properties:
              incident_report:
                $ref: '#/definitions/IncidentReport'
        '403':
          description: There was an issue with your API credential or permissions.
        '409':
          description: Incident Report must have a status of 'sent'.
        '422':
          description: Unable to approve remediations
      tags:
      - Incident Reports
      operationId: postV1IncidentReportsIncidentReportIdRemediationsBulkApproval
  /v1/incident_reports/{incident_report_id}/remediations/bulk_rejection:
    post:
      summary: Bulk Reject Remediations
      description: 'Reject all unapproved remediations for an Incident Report. Rejecting the remediations will send the incident report back to the Huntress SOC.


        This endpoint requires an API key with permissions to write to remediations. **Note that the default account API key is read-only, so you''ll need to create a user-based API key with the appropriate permissions to access this endpoint**.

        '
      produces:
      - application/json
      consumes:
      - application/json
      parameters:
      - in: path
        name: incident_report_id
        type: integer
        format: int32
        required: true
      - name: RemediationBulkRejectionParameters
        in: body
        required: true
        schema:
          $ref: '#/definitions/RemediationBulkRejectionParameters'
      responses:
        '201':
          description: Remediations rejected.
        '403':
          description: There was an issue with your API credential or permissions.
        '409':
          description: Incident Report must have a status of 'sent'.
        '422':
          description: Unable to reject remediations
      tags:
      - Incident Reports
      operationId: RemediationBulkRejectionParameters
definitions:
  Remediation:
    type: object
    properties:
      id:
        type: integer
        format: int64
        example: 1
        description: A unique identifier for a remediation.
      type:
        type: string
        example: manual
        description: 'The type of the remediation. Can be one of: assisted, manual, containment'
      action:
        type: string
        example: Delete File
        description: Description of the remediation's required steps.
      parameters:
        type: array
        items:
          type: string
        example:
        - name: path
          description: c:\windows\system32\tasks\malicious_task
        description: Additional context on how the remediation will be performed.<br>For containment remediations, this will be a string showing the entity to which the remediation was applied.<br>For assisted remediations this will be an array of key value pairs representing all the parameters that are related to the remediation.<br>Manual remediations will have no information.
      status:
        type: string
        example: completed
        description: 'The status of the remediation. Can be one of: unapproved, approved, completed, failed, cancelled'
      approved_at:
        type: string
        format: date-time
        example: '2025-06-26T18:57:03Z'
        description: ISO-8601 formatted timestamp for when the remediation was approved.
      approved_by:
        $ref: '#/definitions/User'
        example:
          id: 123123
          name: John Smith
          email: john.smith@example.com
        description: The user that approved the remediation.
      completed_at:
        type: string
        format: date-time
        example: '2025-06-26T18:57:03Z'
        description: ISO-8601 formatted timestamp for when the remediation was completed.
    description: Remediation model
  IncidentReport:
    type: object
    properties:
      id:
        type: integer
        format: int64
        example: 1
        description: A unique identifier for an incident report.
      account_id:
        type: integer
        format: int64
        example: 5
        description: Unique identifier for the account this incident report is associated with.
      agent_id:
        type: integer
        format: int64
        example: 12
        description: Unique identifier for the agent this incident report is associated with.
      body:
        type: string
        example: <Content>
        description: Autogenerated content describing the details of the incident in question.
      closed_at:
        type: string
        format: date-time
        example: '2022-03-15T14:22:00Z'
        description: ISO-8601 formatted timestamp for when this incident report had its status set to `closed`. Null if non-applicable.
      indicator_counts:
        type: object
        example:
          footholds: 1
          monitored_files: 0
          process_detections: 0
          ransomware_canaries: 0
          antivirus_detections: 0
        description: Mapping of indicator types to number of incidences of that threat in the context of this incident report.
      indicator_types:
        type: array
        items:
          type: string
        example:
        - footholds
        description: Unique list of threat indicators that have been found in the context of this incident report.
      organization_id:
        type: integer
        format: int64
        example: 4
        description: Unique identifier for the organization this incident report is associated with.
      platform:
        type: string
        example: windows
        description: The platform of the host machine (`darwin`,`google`,`microsoft_365`,`linux`,`windows`, or `other`).
      remediations:
        type: object
        example:
          total_count: 1
          has_more: false
          items:
          - id: 1
            type: manual
            action: Delete File
            parameters:
            - name: path
              description: c:\windows\system32\tasks\malicious_task
            status: completed
            approved_at: '2025-06-26T18:57:03Z'
            approved_by:
              id: '123123'
              email: john.smith@example.com
              name: John smith
            completed_at: '2025-06-26T18:57:03Z'
        description: This represents an itemized list of the first 10 remediations for an incident report. If there are more than 10, use the remediations endpoint to retrieve information about them.
      sent_at:
        type: string
        format: date-time
        example: '2022-03-01T21:00:00Z'
        description: ISO-8601 formatted timestamp for when a Huntress SOC analyst has notified necessary parties regarding this incident report. Null if not sent.
      severity:
        type: string
        example: low
        description: The severity of the incident report. Can be one of `low`, `high`, `critical`.
      status:
        type: string
        example: closed
        description: Status of the incident report. Can be one of `sent`, `closed`, `dismissed`
      status_updated_at:
        type: string
        format: date-time
        example: '2022-03-15T14:22:00Z'
        description: ISO-8601 formatted timestamp for when the status of this incident report was last updated.
      subject:
        type: string
        example: LOW - Incident on laptop01 (Test)
        description: Autogenerated one-line description of the incident.
      summary:
        type: string
        example: Huntress detected a malicious scheduled task on this host. We recommend removing the file and scheduled task listed in the remediation steps below.
        description: Details of the incident report, as provided by a Huntress SOC analyst.
      updated_at:
        type: string
        format: date-time
        example: '2022-03-01T20:31:30Z'
        description: ISO-8601 formatted timestamp for when this incident report was last updated.
    description: IncidentReport model
  User:
    type: object
    properties:
      id:
        type: integer
        format: int64
        example: 1
        description: A unique identifier for the user.
      email:
        type: string
        example: john.smith@example.com
        description: The user's email.
      name:
        type: string
        example: John Smith
        description: The user's name.
  RemediationBulkRejectionParameters:
    type: object
    properties:
      comment:
        type: string
        description: A description of why the remediations were rejected. This explanation helps Huntress SOC analysts fix the remediation plan and re-issue the incident report.
      useful:
        type: boolean
        description: Whether or not the remediation plan was useful.
      name:
        type: string
        description: Name of the user rejecting the remediations. Falls back to the user attached to the API key if not provided.
      phone_number:
        type: string
        description: Phone number to be contacted by the Huntress SOC. Falls back to the phone number of the user attached to the API key if not provided.
      email:
        type: string
        description: Email to be contacted by the Huntress SOC. Falls back to the email of the user attached to the API key if not provided.
    required:
    - comment
    - useful
    description: Bulk Reject Remediations Remediations
  Pagination:
    type: object
    properties:
      next_page_url:
        type: string
      next_page_token:
        type: string
    description: Pagination model
securityDefinitions:
  basic_auth:
    type: basic
    desc: Base 64 encoded string of your Huntress Account API key and API secret.